create.cprewritten.net Open in urlscan Pro
2606:4700:20::ac43:47f7 Public Scan

URL: https://community.cprewritten.net/
Title: Community

URL: https://cprewritten.net/help/
Title: Help

URL: https://community.cprewritten.net/legal/
Title: Legal

URL: https://twitter.com/cprewritten/
Title: Social

URL: https://play.cprewritten.net/
Title: Play Now!

URL: https://cprewritten.net/help/articles/privacy_policy.html
Title: PRIVACY POLICY

URL: https://community.cprewritten.net/legal-disclaimer/
Title: LEGAL DISCLAIMER

URL: https://cprewritten.net/help/articles/club_penguin_rules.html
Title: CLUB PENGUIN REWRITTEN RULES

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 46

https://pubgalaxy-com.videoplayerhub.com/gallery.js HTTP 301
https://btloader.com/tag?h=pubgalaxy-com&upapi=true

Request Chain 54

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fcreate.cprewritten.net%2F&domain=create.cprewritten.net&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=qzkfsHwySnU2amNRMnoyNHgydFcveXRpU1NTWDBiTU1EWFQrMTFXZTE0aWk3RDFKVEs5YTQvc1YrWTZhMk50ZG1SOGRoMm5ISHFyMUxDd2Qyc0tIWldSamdVczJrdmw4QmxnQmtoRk9LN0E0anlHRVNxdHVsZm9DRGhNV0hUZnZkc1FWZ0Y2Z3FsVXdSQzJUUlpmQVBVczI3TnRyWExFelRkS1l1UGk4N3hjYXoyQ1Fjc3JMTFNWWlFCQVVvcXA2UHI4VW9yZkZ6ZHpVbXJxVlpPd1V1VGMxMStuditIVUl4ZFF3NXUvbVpNb0JZV2tpWWxJR1EvMndhblVrcXNGczh1aWVGfA&cppv=2

Request Chain 84

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t

Request Chain 93

https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D?gdpr=0 HTTP 302
https://s.amazon-adsystem.com/ecm3?id=9A300A08850D4F8E9BE6AC768CE8B8A1&ex=simpli.fi&status=ok

Request Chain 95

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0 HTTP 302
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1

Request Chain 97

https://ssbsync-us.smartadserver.com/api/sync?callerId=2&gdpr=0 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=6265046972229500172&gdpr=0&gdpr_consent=

Request Chain 98

https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr=0 HTTP 302
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=0&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D HTTP 302
https://id5-sync.com/c/495/0/0/1.gif?gdpr=0&gdpr_consent= HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOeHO4E2l_im5mwm1XziuByWMZngabgg1G8Ohvnw

Request Chain 99

https://cdn.districtm.io/ids/?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D&gdpr=0 HTTP 301
https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D&gdpr=0

Request Chain 104

https://ib.adnxs.com/getuid?https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid=%24UID&ex=appnexus.com&gdpr=0 HTTP 302
https://s.amazon-adsystem.com/ecm3?id=402116596189329890&ex=appnexus.com&gdpr=0

Request Chain 105

https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0 HTTP 302
https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1

Request Chain 106

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID&gdpr=0 HTTP 302
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2610069735325096551171

Request Chain 108

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YgBvUgAEUHzwywBH HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YgBvUgAEUHzwywBH&_test=YgBvUgAEUHzwywBH

Request Chain 110

https://match.adsrvr.org/track/cmf/openx?oxid=3d9b9aad-9302-3478-71e2-507e341d6770&gdpr=0 HTTP 302
https://match.adsrvr.org/track/cmb/openx?oxid=3d9b9aad-9302-3478-71e2-507e341d6770&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=de71345a-edfe-429a-9e27-b13a5e9ebea0&ttd_puid=3d9b9aad-9302-3478-71e2-507e341d6770

Request Chain 111

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTFmNDQ5NjctNWE3NS02YWRjLTY0MDItMGFjN2ZlZmZhOTEw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTFmNDQ5NjctNWE3NS02YWRjLTY0MDItMGFjN2ZlZmZhOTEw&google_tc=

Request Chain 112

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc= HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHPkJm1TavmgL28-Ue07afk&google_cver=1

Request Chain 114

https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID HTTP 302
https://rtb.gumgum.com/usersync?b=apn&i=402116596189329890

Request Chain 115

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_a7c4269f-d61c-4107-a186-69e506753a7b&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_a7c4269f-d61c-4107-a186-69e506753a7b&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgumgum2 HTTP 307
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgumgum2 HTTP 302
https://x.bidswitch.net/sync?dsp_id=59&user_id=02fc5ae8-6530-46b1-ae91-c7bb6de8b48a&ssp=gumgum2 HTTP 302
https://rtb.gumgum.com/usersync?b=bsw&i=71752e87-3832-4eac-809a-985a64d26fbc

Request Chain 116

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
https://rtb.gumgum.com/usersync?b=obn&i=ENC%28t9TsB3H_7qsk5Y6AJcQr_0_d5ALN7K1Lt9nS0fTbFbjVTUzFWH2X8dyGGHsEQa1S%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28t9TsB3H_7qsk5Y6AJcQr_0_d5ALN7K1Lt9nS0fTbFbjVTUzFWH2X8dyGGHsEQa1S%29 HTTP 302
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_a7c4269f-d61c-4107-a186-69e506753a7b&obuid=ENC(t9TsB3H_7qsk5Y6AJcQr_0_d5ALN7K1Lt9nS0fTbFbjVTUzFWH2X8dyGGHsEQa1S) HTTP 302
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51 HTTP 302
https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=15268 HTTP 302
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=KZBZNC43-2-ITLV

Request Chain 117

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
https://rtb.gumgum.com/usersync?b=opx&i=caa63edd-bb17-0c2e-1699-4093fc4d6636

Request Chain 118

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent= HTTP 302
https://rtb.gumgum.com/usersync?b=sta&i=0-6af94e52-d649-4295-569b-a02b54df408d$ip$149.56.153.181

Request Chain 119

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent= HTTP 302
https://rtb.gumgum.com/usersync?b=oth&i=y-mwgaJQNE2peeJR.bcQTipoeuW3xJhVJQ0eBH~A

Request Chain 120

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
https://rtb.gumgum.com/usersync?b=vnt&i=6e1e8e34-87b1-11ec-a9bf-a10e15a78249

Request Chain 121

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D HTTP 307
https://rtb.gumgum.com/usersync?b=snc&i=F941146CDB0C425A957A99437B9BDF02

Request Chain 123

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_a7c4269f-d61c-4107-a186-69e506753a7b&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
https://stags.bluekai.com/site/23178?id=aj9NLrm3qPua4QBfxJuE&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2YLKHFHEY4TNGNYVA5LBGRIUEZTYJJ2UK&gdpr=0 HTTP 302
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2YLKHFHEY4TNGNYVA5LBGRIUEZTYJJ2UK HTTP 302
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=aj9NLrm3qPua4QBfxJuE

Request Chain 124

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
https://rtb.gumgum.com/usersync?b=idi&i=047ad20d-3ecb-4909-bd9a-dce86fe66783

Request Chain 125

https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent= HTTP 302
https://sync.1rx.io/usersync2/floor6?zcc=1&cb=1644195666909 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6395897304 HTTP 302
https://sync.1rx.io/usersync/tradedesk/de71345a-edfe-429a-9e27-b13a5e9ebea0 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005 HTTP 302
https://rtb.gumgum.com/usersync?b=rhy&i=RX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005

Request Chain 126

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
https://rtb.gumgum.com/usersync?b=pln&i=KYxsYg8f1MpS&ev=1&pid=558355

Request Chain 127

https://ssbsync.smartadserver.com/api/sync?callerId=15 HTTP 302
https://rtb.gumgum.com/usersync?b=sad&i=6265046972229500172&gdpr=0&gdpr_consent=

Request Chain 130

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1 HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=

Request Chain 131

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1 HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=

Request Chain 132

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3 HTTP 302
https://ssum.casalemedia.com/usermatchredir?s=186046&cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DGM7HYz3VFjuymbiqnJLyjuPy%26source_user_id%3D__UID__ HTTP 302
https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=YgBvUjbsKtG9r1wKyiASNgAA%26023

Request Chain 133

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1 HTTP 302
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=

Request Chain 134

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
https://rtb.gumgum.com/usersync?b=mmh&i=30bf6200-6f52-4100-a005-c1ed9289aa7e&gdpr=0&gdpr_consent=

Request Chain 135

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
https://rtb.gumgum.com/usersync?b=atm&i=YgBvUgAEUHzwywBH&gdpr=0&gdpr_consent=

Request Chain 136

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9hN2M0MjY5Zi1kNjFjLTQxMDctYTE4Ni02OWU1MDY3NTNhN2I=&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9hN2M0MjY5Zi1kNjFjLTQxMDctYTE4Ni02OWU1MDY3NTNhN2I=&gdpr=0&gdpr_consent=&google_tc=

Request Chain 138

https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X HTTP 302
https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X HTTP 307
https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1

Request Chain 139

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://rtb.gumgum.com/usersync?b=ttd&i=de71345a-edfe-429a-9e27-b13a5e9ebea0&t=1646787666

Request Chain 140

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
https://eus.rubiconproject.com/usync.html?p=gumgum

Request Chain 141

https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID HTTP 302
https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID&b64_redirect=aHR0cHM6Ly9ydGIuZ3VtZ3VtLmNvbS91c2Vyc3luYz9iPWVteCZpPSRFTVhVSUQ= HTTP 302
https://cs.emxdgt.com/umcheck?apnxid=402116596189329890&redirect=https://rtb.gumgum.com/usersync?b=emx&i=$EMXUID&b64_redirect=aHR0cHM6Ly9ydGIuZ3VtZ3VtLmNvbS91c2Vyc3luYz9iPWVteCZpPSRFTVhVSUQ= HTTP 302
https://rtb.gumgum.com/usersync?b=emx&i=402116596189329890brt57451644195666818539a2

Request Chain 142

https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
https://rtb.gumgum.com/usersync?b=sus&i=YgBvU8Co8XUAAO811dcAAAAA

Request Chain 143

https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
https://rtb.gumgum.com/usersync?b=rth&i=a7DYWApkJarPJWIbfihw&pi=gumgum&tc=1

Request Chain 146

https://ib.adnxs.com/getuid?&https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an HTTP 302
https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=402116596189329890&pn_id=an

Request Chain 147

https://x.bidswitch.net/sync?&ssp=yieldmo HTTP 302
https://x.bidswitch.net/ul_cb/sync?&ssp=yieldmo HTTP 302
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=yieldmo HTTP 302
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=yieldmo HTTP 302
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=e8e0816b-2dbe-4774-9ede-25a0a0db6db1&ssp=yieldmo HTTP 302
https://ads.yieldmo.com/sync?userid=71752e87-3832-4eac-809a-985a64d26fbc&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=

Request Chain 148

https://match.adsrvr.org/track/cmf/generic?&ttd_pid=yieldmo HTTP 302
https://ads.yieldmo.com/v000/sync?tdid=de71345a-edfe-429a-9e27-b13a5e9ebea0

Request Chain 149

https://sync.srv.stackadapt.com/sync?&nid=21 HTTP 302
https://ads.yieldmo.com/sync?pn_id=stk&userid=iaXU0zWeTANB7OlDhqwleZU4mbU

Request Chain 150

https://bh.contextweb.com/bh/rtset?&pid=561118&ev=1&rurl=https://sync-pp.ads.yieldmo.com/sync?userid=%%VGUID%%&pn_id=pp HTTP 302
https://sync-pp.ads.yieldmo.com/sync?userid=HPxKEVXFcu56&ev=1&pn_id=pp&pid=561118

Request Chain 152

https://pixel.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=HbDlYh3k4GAG4eE2Grr4ahyxsDMGtrAzH-P6eTW8

Request Chain 154

https://um.simpli.fi/lj_match?r=1644195666626&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=9A300A08850D4F8E9BE6AC768CE8B8A1

Request Chain 155

https://aorta.clickagy.com/pixel.gif?ch=185&cm=c1243ebe78df80deee655c12&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=84&3pid=c:5a4b023959421b5a5a2e9b1c479f109d

Request Chain 156

https://px.owneriq.net/eucm/p/sv?gdpr=0&gdpr_consent= HTTP 302
https://px.owneriq.net/ecc?redir=https%3a%2f%2fpx.owneriq.net%2ffr%2fepx.gif&uid=Q6974820661065218524&ref=%2Feucm%2Fp%2Fsv HTTP 302
https://px.owneriq.net/fr/epx.gif

Request Chain 159

https://match.adsrvr.org/track/cmf/casale HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&expiration=1646787666&gdpr=0&gdpr_consent=

Request Chain 161

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YgBvUjbsKtG9r1wKyiASNgAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1

Request Chain 162

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YgBvUjbsKtG9r1wKyiASNgAAABcAAAAB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEE1l0S-_CQyw89FMT7Eupms&google_cver=1

Request Chain 164

https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=9A300A08850D4F8E9BE6AC768CE8B8A1

Request Chain 166

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1 HTTP 302
https://casale-match.dotomi.com/match/bounce/current?DotomiTest=7f787ea12d981215&is_secure=true&networkId=19998&version=1 HTTP 302
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGbaO_ZqcH7AMevPQjAAAAAAA&expiration=1644282066&is_secure=true

Request Chain 170

https://id5-sync.com/i/341/8.gif?id5id=ID5*aqPEuVjDC4y2SX1XQF3eImw92GuwJEyVDNDBwMi0dvYHLKgF0XgpKS9Iah_qg9E2By2QkyMmTt0dSwH5qkx4ywcu1AIufkBClE_Wkh5w6GgHLwA6B9dT8HG4o7pSQ7ZlBzCOToktgJB-xxx-Ah24Zwcx2dGpUC_BGZlP6rYm7JsHMlSmx-sk35glDVwEHRHdBzNo3Daja5diZxCmNK-JJQc0FykYzAMtGiz4oRBqG8MHNdMuzTOVD9ICMetduYpQBzb0ttR9YuQlBP_3tRF6mQc3bZNocNRJcsD9F4CVLfkHOLgpJVMqphU1vU9e1FUwBzkxThwCEHt7Jaht1TNUtQc6Js9cnkBYQ-LrLldJs4EHOxn4bPswOAmgGxPADPcGBzyx0rfqTlbv0NQB0Q5QOAc9t4dgkteR8t8UHGEhxrYHPnuKDqjNLgxMT7jBqGE2Bz82NRXGL-id5M09hnPtPgdAPlMrmQlUOSPFUUzLGbMHQQyu_pT6yTWeSQPq4MlOB0JyWYpfghn3_2rkcVd65AdDNBkHj6CxX65zr3xEiuMHROCC6vtPzXfeewAj2uVxB0WjluWblYjbkbkqSt9MFAdG-lTluUq750jdTqociP0&o=api&gdpr_consent=undefined&gdpr=0 HTTP 302
https://ib.adnxs.com/getuid?https://id5-sync.com/c/341/2/7/2.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/c/341/2/7/2.gif?puid=402116596189329890&gdpr=0&gdpr_consent= HTTP 302
https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-ZHMOeHO4E2l_im5mwm1XziuByWMZngabgg1G8Ohvnw&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F3%2F6%2F3.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/c/341/3/6/3.gif?puid=30bf6200-6f52-4100-a005-c1ed9289aa7e&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/k/264.gif?puid=de71345a-edfe-429a-9e27-b13a5e9ebea0&ttl=%%TTL%% HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F429%2F4%2F5.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0 HTTP 302
https://id5-sync.com/c/341/429/4/5.gif?puid=235A5332-1129-4F0C-B691-00DE56507837&gdpr=0&gdpr_consent= HTTP 302
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F434%2F3%2F6.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent= HTTP 302
https://id5-sync.com/c/341/434/3/6.gif?puid=952fd169-ed03-491c-b5a2-af70efd0d80c&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F108%2F2%2F7.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F108%2F2%2F7.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/c/341/108/2/7.gif?puid=c766176e-12cb-44dd-85d3-74dfcdc3f874&gdpr=0&gdpr_consent= HTTP 302
https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F136%2F1%2F8.gif%3Fpuid%3D%24%7BTM_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://id5-sync.com/c/341/136/1/8.gif?puid=YgBvUgAEUHzwywBH&gdpr=0&gdpr_consent= HTTP 302
https://sync.go.sonobi.com/us.gif?nw=i5mm&nuid=30bf6200-6f52-4100-a005-c1ed9289aa7e&gdpr=0&consent=&id5id=ID5-ZHMOeHO4E2l_im5mwm1XziuByWMZngabgg1G8Ohvnw

Request Chain 175

https://c1.adform.net/serving/cookie/match?party=14&cid=235A5332-1129-4F0C-B691-00DE56507837 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=235A5332-1129-4F0C-B691-00DE56507837

Request Chain 176

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgBvUgAEUHzwywBH&gdpr=0&gdpr_consent=

Request Chain 178

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=I1pTMhEpTwy2kQDeVlB4Nw%3D%3D HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Request Chain 179

https://idsync.rlcdn.com/420486.gif?partner_uid=235A5332-1129-4F0C-B691-00DE56507837 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJDIzNUE1MzMyLTExMjktNEYwQy1CNjkxLTAwREU1NjUwNzgzNxAAGg0I096BkAYSBQjoBxAAQgBKAA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=6f49463c52626b8dbb33f98d0d6622f01734e53e2db612670ef23da4e39e90ae791426b5417dce21&_=2 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA2ZjQ5NDYzYzUyNjI2YjhkYmIzM2Y5OGQwZDY2MjJmMDE3MzRlNTNlMmRiNjEyNjcwZWYyM2RhNGUzOWU5MGFlNzkxNDI2YjU0MTdkY2UyMRAAGgwI096BkAYSBAgCEABCAEoA HTTP 302
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA2ZjQ5NDYzYzUyNjI2YjhkYmIzM2Y5OGQwZDY2MjJmMDE3MzRlNTNlMmRiNjEyNjcwZWYyM2RhNGUzOWU5MGFlNzkxNDI2YjU0MTdkY2UyMRAAGgwI096BkAYSBAgCEABCAEoA&google_gid=CAESECgaKAIdVVT6SxmS36K2Rjk&google_cver=1 HTTP 307
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
https://idsync.rlcdn.com/458249.gif?partner_uid=516a1e99-aebe-4cc2-96bb-116ad199c4db

Request Chain 180

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=30bf6200-6f52-4100-a005-c1ed9289aa7e

Request Chain 181

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MjM1QTUzMzItMTEyOS00RjBDLUI2OTEtMDBERTU2NTA3ODM3&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 182

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBolY2sOIlstY8Fiaosuq0E&google_cver=1

Request Chain 183

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:9A300A08850D4F8E9BE6AC768CE8B8A1

Request Chain 184

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8645764599013987625&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 185

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=de71345a-edfe-429a-9e27-b13a5e9ebea0

Request Chain 187

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&gdpr=0&us_privacy=1---&khaos=KZBZNC43-2-ITLV HTTP 302
https://s.amazon-adsystem.com/ecm3?id=KZBZNC43-2-ITLV&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1---

Request Chain 189

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&gdpr_consent=undefined&gdpr=0&us_privacy=1---&khaos=KZBZNC43-2-ITLV HTTP 302
https://rtb.gumgum.com/usersync?b=mag&i=KZBZNC43-2-ITLV&gdpr=0&gdpr_consent=undefined&us_privacy=1---

Request Chain 198

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy= HTTP 301
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

Request Chain 199

https://ssc-cms.33across.com/ps/?_=1644195666625.&ri=0013300001r0t9mAAA&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X HTTP 302
https://rtb.gumgum.com/usersync?b=tta&i=1889320954033

Request Chain 200

https://x.bidswitch.net/sync?ssp=the33across&us_privacy= HTTP 302
https://pixel.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=the33across&gdpr=&gdpr_consent= HTTP 302
https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=the33across&gdpr=0&user_id=yRRIqMlATarSRUz8zh5VoMgVHfnSEh35y0chF5pi HTTP 302
https://ssc-cms.33across.com/ps/?gdpr_consent=&ri=10&ru=https%3A%2F%2Fcms-xch.33across.com%2Fmatch%3Fgdpr_58%3D%24gdpr_58%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26bidder_id%3D10%26external_user_id%3D71752e87-3832-4eac-809a-985a64d26fbc HTTP 302
https://cms-xch.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=71752e87-3832-4eac-809a-985a64d26fbc HTTP 301
https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=71752e87-3832-4eac-809a-985a64d26fbc

Request Chain 201

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1644195666625.4&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fcms-xch-chicago.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D1%2526external_user_id%253D%255BMM_UUID%255D HTTP 302
https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D HTTP 302
https://cms-xch-chicago.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=30bf6200-6f52-4100-a005-c1ed9289aa7e

Request Chain 202

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true HTTP 302
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-RFtpARhE2uG8pr2edXWubi8eikQgO_mK~A HTTP 302
https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-RFtpARhE2uG8pr2edXWubi8eikQgO_mK%7EA&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 203

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy= HTTP 302
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=522459806dd21216&is_secure=true&networkId=78390&version=1&us_privacy= HTTP 302
https://ssc-cms.33across.com/ps?xi=64&xu=AAAGbUjMVg5JugM6PlSvAAAAAAA&expiration=1644282067&is_secure=true&us_privacy= HTTP 302
https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGbUjMVg5JugM6PlSvAAAAAAA&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 204

https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy= HTTP 302
https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1646787667%26external_user_id%3Dde71345a-edfe-429a-9e27-b13a5e9ebea0 HTTP 302
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1646787667&external_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0

Request Chain 205

https://ssum-sec.casalemedia.com/usermatchredir?s=194558&us_privacy=1---&cb=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Dindexexchange%26us_privacy%3D1---%26uid%3D HTTP 302
https://mp.4dex.io/setuid?bidder=indexexchange&us_privacy=1---&uid=YgBvUjbsKtG9r1wKyiASNgAAABcAAAAB

Request Chain 207

https://pixel.advertising.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
https://pixel.advertising.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true&apid=UP6e52e484-87b1-11ec-8865-0248f07108fb HTTP 302
https://dmx.districtm.io/s/10051/y-sNqXUUFE2uFAAZMOreygODtuxnB33KxO~A~UP6e52e484-87b1-11ec-8865-0248f07108fb

Request Chain 208

https://ums.acuityplatform.com/tum?umid=137&rurl=https%3A%2F%2Fdmx.districtm.io%2Fs%2F10022%2F___AUID___ HTTP 302
https://dmx.districtm.io/s/10022/645441767744

Request Chain 209

https://x.bidswitch.net/sync?ssp=districtm&user_id=24lCDZJoCmwwPqWAfGzxpLmqMY1 HTTP 302
https://ums.acuityplatform.com/bum?tpid=29&uid=71752e87-3832-4eac-809a-985a64d26fbc&bidswitch_ssp_id=districtm HTTP 302
https://x.bidswitch.net/sync?dsp_id=236&user_id=645441716633&expires=30&user_group=1&ssp=DistrictM

Request Chain 210

https://districtm-match.dotomi.com/match/bounce/current?version=1&networkId=33921&nuid=24lCDZJoCmwwPqWAfGzxpLmqMY1&rurl=//dmx.us-east-31.districtm.io/s/10007/ HTTP 302
https://districtm-match.dotomi.com/match/bounce/current?DotomiTest=24654c9f9ab01215&is_secure=true&version=1&networkId=33921&nuid=24lCDZJoCmwwPqWAfGzxpLmqMY1&rurl=%2F%2Fdmx.us-east-31.districtm.io%2Fs%2F10007%2F HTTP 302
https://dmx.us-east-31.districtm.io/s/10007/AAAGbUjMVg5JtwNIMccsAAAAAAA&expiration=1644282067&nuid=24lCDZJoCmwwPqWAfGzxpLmqMY1&is_secure=true

Request Chain 211

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=96 HTTP 302
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=96 HTTP 302
https://dmx.districtm.io/s/10001/74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341

Request Chain 213

https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D&gdpr=0&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=30bf6200-6f52-4100-a005-c1ed9289aa7e&expires=28

Request Chain 214

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHMovqcTjQaXTEN1lrmVl84&google_cver=1

Request Chain 215

https://token.rubiconproject.com/token?pid=26594&gdpr=0&us_privacy=1--- HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZBZNC43-2-ITLV&sigv=1&esig=2~27ba697e78ce8237190681d99da29dc5a4d19147&gdpr=0&us_privacy=1---

Request Chain 216

https://match.adsrvr.org/track/cmf/rubicon?gdpr=0&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=&expires=30

Request Chain 217

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&gdpr=0&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgBvUgAEUHzwywBH&gdpr=0&us_privacy=1---

Request Chain 218

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0&us_privacy=1--- HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/AU4wAVlxOWOq-Xj1-Uq_LA?csrc=&gdpr=0&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=791549314977830494

Request Chain 219

https://token.rubiconproject.com/token?pid=25470&gdpr=0&us_privacy=1--- HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pCWk5DNDMtMi1JVExW&gdpr=0&us_privacy=1---

Request Chain 221

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1&gdpr=0

Request Chain 222

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YgBvUjbsKtG9r1wKyiASNgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1

Request Chain 223

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEH8fcMYNwiW1QaPqyx18nyI&google_cver=1

Request Chain 224

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAyMTE2NTk2MTg5MzI5ODkw

Request Chain 239

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&gdpr_consent=undefined&gdpr=0&us_privacy=1---&khaos=KZBZNC43-2-ITLV HTTP 302
https://ssc-cms.33across.com/ps/?xi=1&xu=KZBZNC43-2-ITLV&gdpr=0&gdpr_consent=undefined HTTP 302
https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KZBZNC43-2-ITLV&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 261

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 264

https://dmx.districtm.io/s/v1/users/10002 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qUnNRMFJhU205RGJYZDNVSEZYUVdaSGVuaHdURzF4VFZreCJ9.c0QYH2HJaRuVXSMsM6ve5-5dvKuAKo6JpVy4GxuU46__iW3O61_e4z4j57S8xtIOkvyOHaRPwbRqsHnCBpr7xA

Request Chain 269

https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID] HTTP 302
https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]&rd=1

Request Chain 270

https://gum.criteo.com/sid/json?origin=publishertag&domain=create.cprewritten.net&sn=ChromeSyncframe&so=0&topUrl=create.cprewritten.net HTTP 302
https://mug.criteo.com/sid?cpp=7sUf-XxGKzh2Nml1V0VJS1FYankxVllVcWFOdDZWV3E3NXIrVjgrbWZjcnc0ei9EZzRSVDhoYng5RmhtUWhnZ3JqYmFtYWJmdEpqNEdGQk5IcjMyNTBMUzZNQ2FsdnVkLzBuL2FUY1ZWNDBLRzRqMWtHR3hEbVNmUnF6T1RrOVJFRzVmMVA0ZzFTM1NldWFPbG55T0tXa1NLWkRsT3JIQytMMHNxNDNiY3VHYTFLKzBRR084bzZQV0p2b1JrYmhEUVJQY0ZNdzhubTlHdDdZYU5kUXg0WFFFNC9RPT18&cppv=2

Request Chain 278

https://ups.analytics.yahoo.com/ups/58368/occ?gdpr=0&gdpr_consent= HTTP 302
https://sync.richaudience.com/1334b6ec0ff0dc970481738a2374448c/?uid=y-wqhVSvdE2uElNtHfOWiIUf3AMP113Ea14KoAszs-~A&gdpr=0&gdpr_consent=

Request Chain 279

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.richaudience.com%2Ff79aa10af28935c0f42d7bcb6a649769%3Fuid%3D%24%7BUSER_ID%7D HTTP 302
https://sync.richaudience.com/f79aa10af28935c0f42d7bcb6a649769?uid=YgBvUgAEUHzwywBH HTTP 301
https://sync.richaudience.com/f79aa10af28935c0f42d7bcb6a649769/?uid=YgBvUgAEUHzwywBH

Request Chain 280

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.richaudience.com%2Fa939d25b950298d0a5d324cea4fcd3d1%2F%3Fuid%3D$UID HTTP 302
https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=402116596189329890

Request Chain 281

https://spl.zeotap.com/?zdid=689&env=mWeb&eventType=pageview HTTP 302
https://sync.richaudience.com/1988B3F6BED450961C9D70DD91/?uuid=1c1d0345-0fde-4ee2-70e7-0301a322d2ae&env=mWeb&eventType=pageview&id_mid_4=1c1d0345-0fde-4ee2-70e7-0301a322d2ae&reqId=14702830-c94d-4607-7065-aa29baf0bf20&zdid=689

Request Chain 283

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=b0d60b5dd6&gdpr=0&gdpr_consent= HTTP 302
https://sync.go.sonobi.com/us.gif?nw=td&nuid=de71345a-edfe-429a-9e27-b13a5e9ebea0&pubid=b0d60b5dd6 HTTP 302
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=570392714&pt=17&dpn=1&dpt=&trid=&pcid=952fd169-ed03-491c-b5a2-af70efd0d80c HTTP 302
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=570392714&pt=17&dpn=1&dpt=&trid=&pcid=952fd169-ed03-491c-b5a2-af70efd0d80c&ckls=true&ci=CqiqFVsEfA&nc=false&trid=-1009392923 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&pu=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1402230080%26mi%3D10%26csh%3D570392714%26rnd%3D40459130%26pcid%3D%23PMUID HTTP 302
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=1402230080&mi=10&csh=570392714&rnd=40459130&pcid=235A5332-1129-4F0C-B691-00DE56507837 HTTP 302
https://ib.adnxs.com/getuid?https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1709765917%26mi%3D10%26csh%3D570392714%3B1402230080%26rnd%3D273752072&pcid=$UID HTTP 302
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=1709765917&mi=10&csh=570392714;1402230080&rnd=273752072&pcid=402116596189329890 HTTP 302
https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1486637409%26mi%3D10%26csh%3D570392714%3B1402230080%3B1709765917%26rnd%3D-1038643359%26pcid%3D HTTP 302
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=1486637409&mi=10&csh=570392714;1402230080;1709765917&rnd=-1038643359&pcid=ca3e7c1d-df44-0c8b-3587-c65dd8552465 HTTP 302
https://ce.lijit.com/merge?pid=8101&3pid=CqiqFVsEfA&location=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D396218182%26mi%3D10%26csh%3D570392714%3B1402230080%3B1709765917%3B1486637409%26rnd%3D770135947%26pcid%3D%5BSOVRNID%5D HTTP 302
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=396218182&mi=10&csh=570392714;1402230080;1709765917;1486637409&rnd=770135947&pcid=c1243ebe78df80deee655c12 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1072441116%26mi%3D10%26csh%3D570392714%3B1402230080%3B1709765917%3B1486637409%3B396218182%26rnd%3D-1123647858%26pcid%3D%24SPOTX_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1072441116%26mi%3D10%26csh%3D570392714%3B1402230080%3B1709765917%3B1486637409%3B396218182%26rnd%3D-1123647858%26pcid%3D%24SPOTX_USER_ID&__user_check__=1&sync_id=6fcc90b0-87b1-11ec-86d2-13033cfc0103 HTTP 302
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=1072441116&mi=10&csh=570392714;1402230080;1709765917;1486637409;396218182&rnd=-1123647858&pcid=6fcc8f83-87b1-11ec-86d2-13033cfc0103 HTTP 302
https://sync.mathtag.com/sync/img?mt_exid=10019&redir=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1678944572%26mi%3D10%26csh%3D570392714%3B1402230080%3B1709765917%3B1486637409%3B396218182%3B1072441116%26rnd%3D-558880280%26pcid=[MM_UUID] HTTP 302
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=1678944572&mi=10&csh=570392714;1402230080;1709765917;1486637409;396218182;1072441116&rnd=-558880280&pcid=30bf6200-6f52-4100-a005-c1ed9289aa7e HTTP 302
https://sync.1rx.io/usersync/intentiq/0?dspret=1&redir=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D541745869%26mi%3D10%26csh%3D570392714%3B1402230080%3B1709765917%3B1486637409%3B396218182%3B1072441116%3B1678944572%26rnd%3D-193767871%26pcid%3D%5BRX_UUID%5D HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005?redir=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D541745869%26mi%3D10%26csh%3D570392714%3B1402230080%3B1709765917%3B1486637409%3B396218182%3B1072441116%3B1678944572%26rnd%3D-193767871%26pcid%3DRX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005 HTTP 302
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=541745869&mi=10&csh=570392714;1402230080;1709765917;1486637409;396218182;1072441116;1678944572&rnd=-193767871&pcid=RX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005

Request Chain 284

https://image8.pubmatic.com/AdServer/ImgSync?p=157230&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
https://pr-bh.ybp.yahoo.com/sync/pubmatic/235A5332-1129-4F0C-B691-00DE56507837?gdpr=0&gdpr_consent=

Request Chain 285

https://us-u.openx.net/w/1.0/pd?plm=6&ph=674700d8-56f8-4e0c-aecf-b9c3ebe8f945&gdpr=0&us_privacy=1--- HTTP 302
https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8645764599013987625&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 286

https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID] HTTP 302
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=30bf6200-6f52-4100-a005-c1ed9289aa7e

Request Chain 288

https://x.bidswitch.net/sync?ssp=sonobi&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=sonobi&bsw_param=71752e87-3832-4eac-809a-985a64d26fbc&google_hm=NzE3NTJlODctMzgzMi00ZWFjLTgwOWEtOTg1YTY0ZDI2ZmJj HTTP 302
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEP9irPkB_WrQuGVbSnTUvN8&google_cver=1&ssp=sonobi&bsw_param=71752e87-3832-4eac-809a-985a64d26fbc HTTP 302
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=71752e87-3832-4eac-809a-985a64d26fbc

Request Chain 293

https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0015a00002oUk4aAAC&us_privacy=1---&ru=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3D33across%26us_privacy%3D1---%26uid%3D33XUSERID33X HTTP 302
https://de.tynt.com/deb/?m=xch&rt=html&id=0015a00002oUk4aAAC&us_privacy=1---&ru=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3D33across%26us_privacy%3D1---%26uid%3D33XUSERID33X

Request Chain 294

https://ssc-cms.33across.com/ps/?us_privacy=1---&ts=1644195669037.4&ri=70&ru=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fcm%3Fid%3Dc6a5ba0d-ce02-41bd-a1ea-842c68bd5108%26ph%3D8f5ed5d4-642c-4222-968a-d709c87ac3c8%26us_privacy%3D%24%7BUS_PRIVACY%7D%26r%3Dhttps%253A%252F%252Fcms-xch-chicago.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D70%2526external_user_id%253D HTTP 302
https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=1---&r=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D1---%26bidder_id%3D70%26external_user_id%3D

Request Chain 295

https://ssc-cms.33across.com/ps/?_=1644195669037.&ri=0015a00002oUk4aAAC&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=1---&ru=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3D33across%26us_privacy%3D1---%26uid%3D33XUSERID33X HTTP 302
https://mp.4dex.io/setuid?bidder=33across&us_privacy=1---&uid=1889320954033

Request Chain 296

https://ssc-cms.33across.com/ps/?us_privacy=1---&ts=1644195669037.2&ri=2&ru=https%3A%2F%2Fssum-sec.casalemedia.com%2Fusermatchredir%3Fs%3D191740%26us_privacy%3D%24%7BUS_PRIVACY%7D%26cb%3Dhttps%253A%252F%252Fcms-xch-chicago.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D2%2526external_user_id%253D HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=191740&us_privacy=1---&cb=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D1---%26bidder_id%3D2%26external_user_id%3D HTTP 302
https://cms-xch-chicago.33across.com/match?liv=h&us_privacy=1---&bidder_id=2&external_user_id=YgBvUjbsKtG9r1wKyiASNgAA%26023

Request Chain 297

https://ssc-cms.33across.com/ps/?us_privacy=1---&ts=1644195669037.3&ri=45&ru=https%3A%2F%2Fpixel-sync.sitescout.com%2Fdmp%2FpixelSync%3Fnid%3D104%26us_privacy%3D%24%7BUS_PRIVACY%7D%26redir%3Dhttps%253A%252F%252Fcms-xch-chicago.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D45%2526external_user_id%253D%257BuserId%257D HTTP 302
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=104&us_privacy=1---&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D1---%26bidder_id%3D45%26external_user_id%3D%7BuserId%7D HTTP 302
https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341%26partner_url%3Dhttps%253A%252F%252Fcms-xch-chicago.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D1---%2526bidder_id%253D45%2526external_user_id%253D74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341 HTTP 302
https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341%26partner_url%3Dhttps%253A%252F%252Fcms-xch-chicago.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D1---%2526bidder_id%253D45%2526external_user_id%253D74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341&xl8blockcheck=1 HTTP 302
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341&partner_url=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D1---%26bidder_id%3D45%26external_user_id%3D74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341 HTTP 302
https://cms-xch-chicago.33across.com/match?liv=h&us_privacy=1---&bidder_id=45&external_user_id=74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341

Request Chain 298

https://ssc-cms.33across.com/ps/?us_privacy=1---&ts=1644195669037.5&ri=90&ru=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3Fhttps%253A%252F%252Fcms-xch-chicago.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D90%2526external_user_id%253D%2524UID HTTP 302
https://ib.adnxs.com/getuid?https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D1---%26bidder_id%3D90%26external_user_id%3D%24UID HTTP 302
https://cms-xch-chicago.33across.com/match?liv=h&us_privacy=1---&bidder_id=90&external_user_id=402116596189329890

Request Chain 299

https://bttrack.com/pixel/cookiesync?source=2c3b95b9-6513-42b2-beb7-260851c73b75&secure=1&us_privacy=1---&cb=1644195669037.6 HTTP 302
https://ssc-cms.33across.com/ps/?xi=66&us_privacy=&xu=4fce1d68-1ee5-4e52-9a5b-a58b8884c3e6 HTTP 302
https://cms-xch-chicago.33across.com/match?bidder_id=66&external_user_id=4fce1d68-1ee5-4e52-9a5b-a58b8884c3e6&ts=1644195669&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 300

https://p.rfihub.com/cm?pub=35686&in=1&us_privacy=1---&lexicon_id=hgea07ce37f3ccc HTTP 302
https://ssc-cms.33across.com/ps/?xi=93&xu=2670225182462427131&us_privacy= HTTP 302
https://cms-xch-chicago.33across.com/match?bidder_id=93&external_user_id=2670225182462427131&ts=1644195669&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 302

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:30bf6200-6f52-4100-a005-c1ed9289aa7e&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=cEBYZXAUXWdrEVwxd0pFbXFBDTRrRg00chPK8dX3 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=71752e87-3832-4eac-809a-985a64d26fbc&gdpr=0&gdpr_consent=&gdpr_pd= HTTP 302
https://x.bidswitch.net/sync?dsp_id=413&ssp=pubmatic&user_id=csonata_7407fbcd-abe4-4f67-98be-f540fd87f2d7&bsw_param=71752e87-3832-4eac-809a-985a64d26fbc&expires=10 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=71752e87-3832-4eac-809a-985a64d26fbc&gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R1D530_EAE49EBB_1BD527FD2&r=https://pmp.mxptint.net/sn.ashx?ak=1 HTTP 302
https://pmp.mxptint.net/sn.ashx?ak=1

Request Chain 303

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFOEdFN0VBTjhBQUd3aXA2Znc4Zw&bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAE8GE7EAN8AAGwip6fw8g&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Csyn%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2 HTTP 302
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Csyn%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AAE8GE7EAN8AAGwip6fw8g&pid=558502&do=add HTTP 303
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAE8GE7EAN8AAGwip6fw8g&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsyn%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID HTTP 302
https://match.prod.bidr.io/cookie-sync?bee_sync_partners=syn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=6265046972229500172 HTTP 303
https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AAE8GE7EAN8AAGwip6fw8g&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D6265046972229500172%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4 HTTP 307
https://match.prod.bidr.io/cookie-sync?userid=6265046972229500172&bee_sync_partners=pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=4 HTTP 303
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAE8GE7EAN8AAGwip6fw8g HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

Request Chain 304

https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent= HTTP 303
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_ea40a8df7d74412eb5374 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=cEBYZXAUXWdrEVwxd0pFbXFBDTRrRg00chPK8dX3 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=71752e87-3832-4eac-809a-985a64d26fbc&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy= HTTP 302
https://x.bidswitch.net/sync?dsp_id=283&user_id=1e121628-8b8a-4738-9916-dcca79e8c86b&expires=1&user_group=5&ssp=pubmatic&bsw_param=71752e87-3832-4eac-809a-985a64d26fbc HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=71752e87-3832-4eac-809a-985a64d26fbc&gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

Request Chain 305

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP 302
https://widget.us.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

Request Chain 306

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP 302
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=70071dda-87b1-11ec-8eff-939f3ca24b13 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://m.fg8dgt.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&ssp_uuid=71752e87-3832-4eac-809a-985a64d26fbc HTTP 302
https://m.fg8dgt.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&ssp_uuid=71752e87-3832-4eac-809a-985a64d26fbc HTTP 302
https://x.bidswitch.net/sync?dsp_id=108&expires=14&ssp=pubmatic&user_id=2d20a41a-6d7a-4fab-b126-b1a5db26070d HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=71752e87-3832-4eac-809a-985a64d26fbc&gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=6292008565231260656 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://sync.resetdigital.co:10001/csync/pubmatic HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTgmdGw9NzIwMA==&piggybackCookie=0000009A81E680AB HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=402116596189329890 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

Request Chain 308

https://pixel.onaudience.com/?partner=214&mapped=235A5332-1129-4F0C-B691-00DE56507837 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1 HTTP 302
https://pixel.onaudience.com/?partner=147&mapped=de71345a-edfe-429a-9e27-b13a5e9ebea0&icm HTTP 302
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D HTTP 302
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=fc5aeb04ac12b8c3d492b26b7b103294 HTTP 302
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25 HTTP 302
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=c0fa8c27a029a690f1d2f7fadd59455a HTTP 302
https://pixel.onaudience.com/?partner=109&icm&cver&smartmap=1&redirect=tags.bluekai.com%2Fsite%2F33141%3F%26id%3D%25m HTTP 302
https://tags.bluekai.com/site/33141?&id=fc6b2bc77fdf0251

Request Chain 309

https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=235A5332-1129-4F0C-B691-00DE56507837&gdpr= HTTP 302
https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=235A5332-1129-4F0C-B691-00DE56507837&gdpr=&fbounce=1 HTTP 302
https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=235A5332-1129-4F0C-B691-00DE56507837&addseg=10,33,39

Request Chain 311

https://io.narrative.io/?companyId=673&id=pubmatic_id:235A5332-1129-4F0C-B691-00DE56507837 HTTP 302
https://io.narrative.io/?io.narrative.guid.v2=700ec4e0-87b1-11ec-9141-120bff9cc4e7&companyId=673&id=pubmatic_id:235A5332-1129-4F0C-B691-00DE56507837

Request Chain 312

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=235A5332-1129-4F0C-B691-00DE56507837&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-CEfA7h1E2uXAdVoCez7Or_XeTw5RFXU-~A&gdpr=0&gdpr_consent=

Request Chain 313

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=235A5332-1129-4F0C-B691-00DE56507837&gdpr=0&gdpr_consent= HTTP 302
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=512733280f1d1216&is_secure=true&networkId=17100&version=1&nuid=235A5332-1129-4F0C-B691-00DE56507837&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAGbUjMVg5KOgMSScEZAAAAAAA&expiration=1644282069&nuid=235A5332-1129-4F0C-B691-00DE56507837&is_secure=true&gdpr_consent=&gdpr=0 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

Request Chain 314

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=6e1e8e34-87b1-11ec-a9bf-a10e15a78249&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=cEBYZXAUXWdrEVwxd0pFbXFBDTRrRg00chPK8dX3

Request Chain 315

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=402116596189329890&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=

Request Chain 317

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=onfocus&endpoint=us-west HTTP 301
https://eus.rubiconproject.com/usync.html?p=onfocus&endpoint=us-west

Request Chain 319

https://pixel-us-west.rubiconproject.com/exchange/sync.php?p=onfocus&gdpr_consent=undefined&gdpr=0&us_privacy=1---&khaos=KZBZNC43-2-ITLV HTTP 302
https://mp.4dex.io/setuid?bidder=rubicon&uid=KZBZNC43-2-ITLV&gdpr=0&gdpr_consent=undefined&us_privacy=1---

Request Chain 322

https://rtb.openx.net/sync/dds HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=4s0QkTqEjVaXlhzJ5wRdyg==&ox_sc=1&ox_init=1 HTTP 302
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

Request Chain 323

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=536872786&val=30bf6200-6f52-4100-a005-c1ed9289aa7e

Request Chain 324

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID} HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537073028&val=6e1e8e34-87b1-11ec-a9bf-a10e15a78249

Request Chain 325

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072977&val=74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341&gdpr=0&gdpr_consent=

Request Chain 327

https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID} HTTP 302
https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=135f1924-4b68-0e31-22c5-9174a3be9319 HTTP 302
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=135f1924-4b68-0e31-22c5-9174a3be9319&apid=UP6e52e484-87b1-11ec-8865-0248f07108fb

Request Chain 328

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D HTTP 302
https://id.rlcdn.com/464246.gif?partner_uid=685de5cb-5e45-0218-2e9b-d08d0d8606a8 HTTP 307
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=685de5cb-5e45-0218-2e9b-d08d0d8606a8

Request Chain 329

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072399&val=402116596189329890

Request Chain 333

https://sync.srv.stackadapt.com/sync?nid=11 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=iaXU0zWeTANB7OlDhqwleZU4mbU

Request Chain 334

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=d9cd0292-435d-483c-99b7-558b3b564b7e&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP 302
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=235A5332-1129-4F0C-B691-00DE56507837

Request Chain 335

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}

Request Chain 336

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:0eWBd8WO1NgSp15&gdpr=0&gdpr_consent=

Request Chain 337

https://ums.acuityplatform.com/tum?umid=6 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=645441716633

Request Chain 338

https://match.bnmla.com/usersync?sspid=10738&redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw%26piggybackCookie%3D%5BUUID%5D HTTP 302
https://um.simpli.fi/bnmlahttps%3A%2F%2Fmatch.bnmla.com%2Fusersync%3Fdspid%3D6%26uuid%3D%24UID HTTP 302
https://match.bnmla.com/usersync?dspid=6&uuid=9A300A08850D4F8E9BE6AC768CE8B8A1 HTTP 302
https://sync.technoratimedia.com/services?srv=cs&pid=70&cb=https%3A%2F%2Fmatch.bnmla.com%2Fusersync%3Fdspid%3D170%26uuid%3D%5BUSER_ID%5D HTTP 307
https://match.bnmla.com/usersync?dspid=170&uuid=F941146CDB0C425A957A99437B9BDF02 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NzUmdGw9MTI5NjAw&piggybackCookie=991c5b1e-f7a8-4719-8399-26119c34efba

Request Chain 341

https://x.bidswitch.net/sync?ssp=adagio&user_id=d36cc864-c0be-4bc7-8b0b-6241c1561862&us_privacy=1--- HTTP 302
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=adagio&bsw_custom_parameter=71752e87-3832-4eac-809a-985a64d26fbc HTTP 302
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=adagio&bsw_custom_parameter=71752e87-3832-4eac-809a-985a64d26fbc HTTP 302
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=c5cdd801-9558-44da-8f0b-e3f0152b75ea&user_group=1&ssp=adagio&bsw_param=71752e87-3832-4eac-809a-985a64d26fbc HTTP 302
https://mp.4dex.io/setuid?bidder=bidswitch&uid=71752e87-3832-4eac-809a-985a64d26fbc&gdpr=&gdpr_consent=&us_privacy=

Request Chain 342

https://ad.360yield.com/server_match?partner_id=1790&us_privacy=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Dimprovedigital%26us_privacy%3D1---%26uid%3D%7BPUB_USER_ID%7D HTTP 302
https://mp.4dex.io/setuid?bidder=improvedigital&us_privacy=1---&uid=047ad20d-3ecb-4909-bd9a-dce86fe66783

340 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
create.cprewritten.net/ 15 KB
4 KB 350ms
287ms Document
text/html 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://create.cprewritten.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

69212b178139e0e30ebe533d097154fc7ccc8d04c1a8d7be8b0e8ca0aae0908e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bmnfsTo0zUbopukOq76rXRaQm2soJUvQcMaK6DMkuum7dHFuTbOYD76rLJv88FtKU6Rzpc5ZNgXNiNmAEyd0QNAVwofQ0mKBH7GffGRSi0wCEvfI5OsOwM%2FmLHxz%2FMfg%2F1wcLelvEApz6EXSs9jdxcDd%2F4c%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 6d98af56c8dc714a-YUL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 club_penguin.css
create.cprewritten.net/css/ 89 KB
18 KB 37ms
36ms Stylesheet
text/css 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://create.cprewritten.net/css/club_penguin.css

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5073858f5f02f7931ebc45f1f2f096fb58a588946c092a5dab81b3d71c4c5fa9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5778
cf-polished: origSize=91296
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 11 Nov 2019 15:15:31 GMT
server: cloudflare
etag: W/"5dc97b13-164a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GIQPNWR2ZUcW2q5byf3RHrfiSwkwE%2FqVAK82PXbi7bzUCYNm6zh9vDQOAsNLM9Ed%2Fwl45wdtcbMwdiWBqVSmt2Gh0U8b4KPhaE0ARc%2B6yO7LSkI02qFnNG8lvTvLJ7dMUhCCKCTuh8A3bWHPbOMECrg%2FmYA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=2678400
cf-ray: 6d98af58bbc9714a-YUL
cf-bgj: minify

GET
H2 200 logo.png
cprewritten.net/img/ 58 KB
58 KB 46ms
33ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cprewritten.net/img/logo.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7de352b94d53cc53bf29d4a3d8053723260708666bedfffe95d802d0cee597d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3923
cf-polished: origFmt=png, origSize=142276
content-disposition: inline; filename="logo.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 59332
last-modified: Fri, 25 Jan 2019 12:20:15 GMT
server: cloudflare
etag: "5c4afeff-22bc4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D8K25j6BVdKpQFAtfCW%2FJh3nfCREs%2BVZzfLDjqGrhITBDcZLvQag74%2B16Ru7tuGAMwJcEIZCyK3TedsXhhoY1tsz%2FYZJ0UEWBfGvrswem%2FkQlDfqthJMldMg8iIBi9dC9QrGm3pEiGcTbp%2FFYA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af58cbee714a-YUL
cf-bgj: imgq:85,h2pri

GET
H2 200 rocket-loader.min.js Show response
create.cprewritten.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 22ms
22ms Script
application/javascript 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://create.cprewritten.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
last-modified: Thu, 03 Feb 2022 11:10:48 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"61fbb838-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GmywWVH9L7xcQymPKNY2wEeRiA%2B4f7%2FwdOeRwNJHLSikNbreSIUf3Pl0eVOXCiXH%2FLrgpzOp032YbBXndEw5DDXiEEj%2FhWtSGe3LbXvniOhAZfNjUmkEwIvNv7FKwvPle3m19eznbG%2BkaITp3rsnNE8UcO8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 6d98af58bbcb714a-YUL
expires: Wed, 09 Feb 2022 01:01:04 GMT

GET
H2 200 rewritten.js Show response
cprewritten.net/js/ 26 KB
8 KB 38ms
37ms Script
application/javascript 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cprewritten.net/js/rewritten.js

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57bfa45b3cf1c819d2de07095defc56eac3589ec658ab116050dad20db200a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5699
cf-polished: origSize=27209
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 10 Aug 2019 00:28:07 GMT
server: cloudflare
etag: W/"5d4e0f97-6a49"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=badNqPiFOgJhz68ObCwnd%2FsJUDs6Wh5tse6bxJnCF6JkdmCS03v9MnZOO7rDlFt9pS5C2hf5fGGymYczMwh%2BuY54FVvBLffFY9pL7fZn11te2PxYhSzohS8FPDbIylHt7aF42Tv%2BZkvux0TxUg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=2678400
cf-ray: 6d98af58ec48714a-YUL
cf-bgj: minify

GET
H3 200 create.js Show response
create.cprewritten.net/js/ 5 KB
2 KB 36ms
35ms Script
application/javascript 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://create.cprewritten.net/js/create.js?v=170321

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

247c7fa07344010432e80fb5cc709c334f8fddd139cb2e66f5e78ebb95d27511

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3669
cf-polished: origSize=6915
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 17 Mar 2021 04:29:01 GMT
server: cloudflare
etag: W/"6051858d-1b03"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=09%2F8vLYPOb8W4fEeOq3zXp1QOJbHt4YUFT6DJSyZ1WlpMWSzdk5cSrJQeiD0T2Oav%2BceOqcuhc2yiEoYpq5NR97p1M4LyEjU0UZE9P4%2FcWKI%2FVujQRnZrKKaRz45GbBZ1TTGTjjEI9bUUKJ74d3l9YdGbZs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=2678400
cf-ray: 6d98af58eb6c4bc5-YUL
cf-bgj: minify

GET
H2 200 lozad.js Show response
cprewritten.net/js/ 2 KB
2 KB 38ms
37ms Script
application/javascript 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cprewritten.net/js/lozad.js

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e28abff43c02288442efb32f2197a0191a1ee8cde4abf5e7c132c22e1b60eb25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5699
cf-polished: origSize=2390
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 06 Jun 2019 19:21:35 GMT
server: cloudflare
etag: W/"5cf967bf-956"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S3q7Um2jvrL89WiJbtXW8ClXdbPi%2B%2B3OD26gEo8opPtkM31mshin3ao%2BtCYYz2Kp4xFhS3Vo9EpORr8IAGY4MqngxqDLs5tdfpJhoTdgn3w2t2Gcv1VeiLN47%2FIVUte29dgHyY1r2LzVaj7WNA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=2678400
cf-ray: 6d98af58ec5a714a-YUL
cf-bgj: minify

GET
H2 200 spf.js Show response
cprewritten.net/js/ 34 KB
13 KB 45ms
43ms Script
application/javascript 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cprewritten.net/js/spf.js

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cba71588aa254d23ecb9c800d8348e3b842b48d4f3146eee58ceedf10f3b9f54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5699
cf-polished: origSize=34636
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 25 Jan 2019 12:08:56 GMT
server: cloudflare
etag: W/"5c4afc58-874c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3f%2BGMzzEBDE92JnC%2BG%2FD55tGTd2FAn4evj1o%2B71n3WD%2FvLb9D6zyk%2BAhV4T6nvRq5zVRgMuDg%2FYqE9DnCR6emL55kQo3U4xGJh6E%2BteOIBHyQOjQpck45%2Fuw%2BodZ0sKH2N8VJlSw0yMREpENfw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=2678400
cf-ray: 6d98af58ec5c714a-YUL
cf-bgj: minify

GET
H2 200 jquery.js Show response
cprewritten.net/js/ 85 KB
31 KB 48ms
47ms Script
application/javascript 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cprewritten.net/js/jquery.js

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1a9c17b50d6278a694406d9e5dce160f81afd7a2683dfdf07f0651c38bdaa8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5699
cf-polished: origSize=86926
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 25 Jan 2019 12:09:03 GMT
server: cloudflare
etag: W/"5c4afc5f-1538e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T%2FkXl7Sl9WCH0%2FhMIX1kxAxAyYy4gCCYuvmYcI5eOJ9SMpACwQ4VbfDBzTHl5y%2Bi0VlglGxCaI5jkY7v1OFbvzOEUbscFFZS%2B7WMHknyPtONH7x%2Fh1vULp%2F5uHcWNdrHZzPY0TCsltOXMpwq7g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=2678400
cf-ray: 6d98af58ec5d714a-YUL
cf-bgj: minify

GET
H2 200 api.js Show response
hcaptcha.com/1/ 83 KB
27 KB 93ms
37ms Script
application/javascript 104.16.168.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hcaptcha.com/1/api.js

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab03efabddb214171abd07c86fa8356048450688ca1aed6886cb43abc1aa5f34

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
via: 1.1 e45a001f96edfc92a3d789e566ab0406.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
age: 0
x-cache: Hit from cloudfront
strict-transport-security: max-age=2592000; includeSubDomains; preload
content-encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 01 Feb 2022 08:29:19 GMT
server: cloudflare
etag: W/"875404c1dbeb746a7477e6fbd2cc9a79"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=120
x-amz-cf-pop: YTO50-C3
cf-ray: 6d98af594ad7cacc-YYZ
x-amz-cf-id: 2eAoox9iYUK-lllt4BWB0N2q7MMq9vNZ5qrEP5siyjN3RgwT-eVQdg==

GET
H2 200 cmp.js Show response
cmp.uniconsent.com/v2/69a34eb934/ 2 KB
1 KB 85ms
30ms Script
application/javascript 2606:4700:3035::6815:20af
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.uniconsent.com/v2/69a34eb934/cmp.js
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:20af , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b21ab9cedd0a654a4f7859ac39607c9ee29d83959d96bf296f2361c900dac430

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 84509
x-cache-status: MISS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 27 Jan 2022 07:09:10 GMT
server: cloudflare
etag: W/"f480fd20fa434534d3a752b42a6f35ee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZuYBsEuFpxXg6pko8i0opcXjP3X1OmMLDQCDuRRzyoFa0ngartR7FyDDJOgedfKGgE7js5fZieELgQP7aXprqpzXsKZZhcxtFH1a%2FXcLAjNq0PMDe%2BY%2Bp%2FpYFVyBZSOmigzUrZjYu3tPiAgcUcIRTm0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400
cf-ray: 6d98af594cee714a-YUL

GET
H2 200 stub.min.js Show response
cmp.uniconsent.com/v2/ 2 KB
1020 B 86ms
31ms Script
application/javascript 2606:4700:3035::6815:20af
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.uniconsent.com/v2/stub.min.js
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:20af , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00bd024e0d7dc09a0455b93e64abe6cbc7a6c1fe0f2a26d6f401413a63f8c222

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 85139
x-cache-status: MISS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 05 May 2020 22:14:14 GMT
server: cloudflare
etag: W/"85d918fcdb3aa9aad25680b956aac992"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3l4DtGGH6ZpIsI8YqjFGnZ8MBWnbW08obcqyBgwzIGHfk5WmJ5cOOmBs%2FqvDPgMBGgKboFpUkUTXzoXYxa8McMPmPTppNbvX6SfoB%2BFCE16a6wrdHWbSrh%2FZMsuzjrmm7dEIqtQMd1ks7%2Fbm47VbOf8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400
cf-ray: 6d98af594cf1714a-YUL

GET
H2 200 css
fonts.googleapis.com/ 569 B
868 B 83ms
34ms Stylesheet
text/css 2607:f8b0:4006:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Material+Icons

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d44a3249e2be052d683c7b58d03890937199b056a6313bd7ae0834281a70a2d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 01:01:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 07 Feb 2022 01:01:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 07 Feb 2022 01:01:04 GMT

GET
H3 200 sub_bg.jpg
create.cprewritten.net/img/ 23 KB
24 KB 31ms
30ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/sub_bg.jpg

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4436308a10eb31311c36b457293f1143715b17be83fe676b31d9785d8a607289

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3629
cf-polished: qual=85, origFmt=jpeg, origSize=179494
content-disposition: inline; filename="sub_bg.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 23398
last-modified: Fri, 25 Jan 2019 12:46:53 GMT
server: cloudflare
etag: "5c4b053d-2bd26"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rgbhl9CrPbgixVrETVlZWdQua%2Fxw%2BHvPBjylwREMpugfZEd8S0cf4gj2LCA6CWbSV6jJaQITr9oxGAydT6A5FndaW8dD0FcrgkjvETiqxweUuGBDQScL4E7WKRnp%2BBmES4PWnxJ%2F8ZlIwvBgdRM4k3rHsko%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af597c1f4bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 banner.png
create.cprewritten.net/img/ 100 B
769 B 53ms
52ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/banner.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

469f72fc6aa1d8b534c28f1f6234089e3f05ef2349271926c3852fb875ec0df4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3669
cf-polished: origFmt=png, origSize=270
content-disposition: inline; filename="banner.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 100
last-modified: Fri, 25 Jan 2019 12:46:42 GMT
server: cloudflare
etag: "5c4b0532-10e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oymEmd7eZesPHy%2FKNmDs3BLymqIUvv%2FroM3aYjGvd1ziWph8ZzmOWACfwP%2FkixrkzB6lEiAkviz4xpWRgKdtTrr1OgBlsfzcgIGntrg0xxmzQxrR2oDKbdH%2Frm%2BVkkNv4oJvAjq6hCEybOIeIKO86SeXVN8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af597c204bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 header-logo.png
create.cprewritten.net/img/ 6 KB
7 KB 75ms
75ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/header-logo.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

721a52d93f4402c30ee0cd436efbfbcbca5ccb54a902c979d3464d2692f244ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3669
cf-polished: origFmt=png, origSize=14476
content-disposition: inline; filename="header-logo.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6396
last-modified: Fri, 25 Jan 2019 12:50:04 GMT
server: cloudflare
etag: "5c4b05fc-388c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5bhbeiSsJg%2FrOvIZy8LhYu44h87HZaAa9tO4gDHC%2BMoPdVzpdfxGMLl6uIM5rfNH%2BdpWXgldFIm7YJsNrkpmh0fCFGuVltKHb0X6L2LMXPF95qD9YaAtho8xlxa21e5WOLAx%2FAJ%2BWw21db6RVVqO3aMy0TE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af597c234bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 header-logo-hover.png
create.cprewritten.net/img/ 7 KB
8 KB 53ms
52ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/header-logo-hover.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da6983e418d0a2a4f4b1c43749272878c10f5cbd7e696af9225366e9eb26eb90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3669
cf-polished: origFmt=png, origSize=15437
content-disposition: inline; filename="header-logo-hover.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7082
last-modified: Fri, 25 Jan 2019 12:49:55 GMT
server: cloudflare
etag: "5c4b05f3-3c4d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GQvnQKMq4cO4ZlGP7YhQ8Xipuh5PxuY6K0NJdco81yiEHJYPsYPXhBjEXv4L%2Fiarz64Wx79bkr9Ahn6w2RDawUAxoSIMXOqnOrNu0VtTNmCEwp3eydgY27KIpJTyqZNuoGqpSXxBrWoydO8pTzOnSAnNbe8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af597c244bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 icon-home.png
create.cprewritten.net/img/ 1 KB
2 KB 75ms
75ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/icon-home.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3bdf52f4b67cdf6a2aa7c9f22c6b3f1d378d220795111e68727015f6082f422b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2849
cf-polished: origFmt=png, origSize=2798
content-disposition: inline; filename="icon-home.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1312
last-modified: Fri, 25 Jan 2019 12:46:50 GMT
server: cloudflare
etag: "5c4b053a-aee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GejaBymtj6o7knyP8PXcR2A0CF4BR3pXhv9LZCzwHFbtUEqfDHpZWYuozpPQSTnhcWl3zaZvmZ8oK1vdbid9Cxw6%2Bmi6Xgsbu4YTxhXzkvPjKdFlYmRW6iOu10ubmRuDp0IYZBWuQmcpu3TA%2B2Px5wiVETY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af598c254bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 icon-community.png
create.cprewritten.net/img/ 2 KB
3 KB 52ms
52ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/icon-community.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

116098c26eecf272ce23e4db0e29009a64ef489d3294aef4db16a875cd9cbebe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2849
cf-polished: origFmt=png, origSize=3216
content-disposition: inline; filename="icon-community.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2382
last-modified: Fri, 25 Jan 2019 12:46:50 GMT
server: cloudflare
etag: "5c4b053a-c90"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IVh6tI0K%2FrxzoW3b1dc32DKFew3%2BsYFFWsf3BxYaPsJhF68OQpIG%2BZDEAakU%2BpuLMGDoP6VN2AtKIGJowc2MJx19SI6vi89hrCi5fUNHxh7E81Ckc%2Ft2xAYFwhWm2AiIbxcXAJbrl%2Fm4CeWovdoZ3ZrhhZw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af598c264bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 icon-legal.png
create.cprewritten.net/img/ 1 KB
2 KB 75ms
75ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/icon-legal.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4f294c7c369af0e1d39602d22b8bc1c2667410123006f40c3b59f69ed9f2b4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2849
cf-polished: origFmt=png, origSize=2856
content-disposition: inline; filename="icon-legal.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1520
last-modified: Fri, 25 Jan 2019 12:46:50 GMT
server: cloudflare
etag: "5c4b053a-b28"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DPsPw5CuCYFdY20YCZinGn6mM2X%2B2fC9JAHo2oC24Uhu%2FO7Q7XEawV3yvw2V0arepXApMImvYCKoQ6sZMZsqI7Am%2FN2cuYmzKtIJe0nXLUgRLiFnXzcOVQD1gBHAM%2BYt2RZw6boqhUnVTcfmvHSK2Wcm8lU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af598c284bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 icon-mod.png
create.cprewritten.net/img/ 1 KB
2 KB 75ms
75ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/icon-mod.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e6a1af80622be82913f24fb0582e973dec72947a775028ad25c940d8a9d868f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2849
cf-polished: origFmt=png, origSize=2762
content-disposition: inline; filename="icon-mod.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1108
last-modified: Fri, 25 Jan 2019 12:46:50 GMT
server: cloudflare
etag: "5c4b053a-aca"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PsSGly%2FsGGyCdYu61QWuFnz%2BVniQBYAEJEm%2F17itBUv9xZxa%2FUvH0pTtP2wX8kObXiqoMzE1qQMokPr3eznDm7IURpn%2Br2YAEH%2B3I99iGvotXwZzgvl6YN6Wuj3EDv5sKR%2BU44x%2FSWaB7bdP1KHUXOBvLsA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af598c2a4bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 icon-social.png
create.cprewritten.net/img/ 1 KB
2 KB 75ms
75ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/icon-social.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

70b3a8d41aebd39eccb1276a805160fa2a83286c92ea2dbbd7e0df35be78972e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2849
cf-polished: origFmt=png, origSize=2891
content-disposition: inline; filename="icon-social.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1526
last-modified: Fri, 25 Jan 2019 12:46:50 GMT
server: cloudflare
etag: "5c4b053a-b4b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SsYKvEPMDDdtNIk%2FafQjfs2c3RCKBDiH%2BX7B4Vs9zwP5oEGDAbIr17QkMBQH6Gbj%2FO951xKU8wPQlWo%2BR9N93MhOt85swWEHjc3xPrlUZB96rHWQmtYn8zUBut050XYiogroW%2Fp%2BBfxdYZkA7isY1kYHCR8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af598c2b4bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 header-play.png
create.cprewritten.net/img/ 3 KB
4 KB 76ms
76ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/header-play.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4bc8a0d7f681e5dfb88bdd1064f16fe45bfae6e23eb8745982b10a691f42c760

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2849
cf-polished: origFmt=png, origSize=4417
content-disposition: inline; filename="header-play.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3014
last-modified: Fri, 25 Jan 2019 12:46:49 GMT
server: cloudflare
etag: "5c4b0539-1141"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cU2OxaJ5K6n1CGBM%2BtmCkYWOAEVJIpdRnNEeEtWyIcMPypC7Lb73Ws8mBX1%2BGgVPstoTEaws5LPwgxMmaTMnqputuUbTfYJDIKaYuhmpu%2BLaXcoAKJAUBsPS1cREAoFvbgBS2t00ZDtCzBe%2BDBtrO1MZE9g%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af598c2d4bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 header-play-hover.png
create.cprewritten.net/img/ 2 KB
3 KB 76ms
76ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/header-play-hover.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a1ae3afddcdb6b93dd3e063120603d631caa37bc9dcd337d9261487e21f329a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2849
cf-polished: origFmt=png, origSize=3789
content-disposition: inline; filename="header-play-hover.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2474
last-modified: Fri, 25 Jan 2019 12:46:49 GMT
server: cloudflare
etag: "5c4b0539-ecd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mcjLmbBjQE9ulBlTo99VAO9cb42dLO98drMx8Jfv0qJ3vHSdnSUjXw8riG67pwhKguvmPOzWrIxNqEecamG1jIs6ggrXOg0eK94FzOxUHdoELgz3pD3lD%2F8TLCQltR%2FtuG5akNZPDLj3DxbA2uqhNDhLHWQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af598c2f4bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 sub_inner_bg.gif
create.cprewritten.net/img/ 58 B
724 B 76ms
76ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/sub_inner_bg.gif

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7bff186249aef31ec41795babb158116ae996c824c06d86ac86fb26a6fa18c96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3669
cf-polished: origFmt=gif, origSize=1383
content-disposition: inline; filename="sub_inner_bg.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 58
last-modified: Fri, 25 Jan 2019 12:46:53 GMT
server: cloudflare
etag: "5c4b053d-567"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l526ELW4K7HZ6f3W0LCmoojLgHdL0M9TDcJFpVBd6ApxjmQ64gn9Se3DRzOdMjFkxZlWirs1baOD3J9Nh9np6TZK5nbJANKauW4UJlKba0C64UCBU5Zkw2P7Ie08hvSgjMd%2F9h80fx7ewqRzwrGSLOaf3V0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af598c304bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 create-penguin.png
create.cprewritten.net/img/ 30 KB
31 KB 76ms
76ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/create-penguin.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6173d6077ea1d79e186f14bed726c277221558e528dd49ac96dd21e178608a92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3669
cf-polished: origFmt=png, origSize=46226
content-disposition: inline; filename="create-penguin.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 30732
last-modified: Fri, 25 Jan 2019 12:46:44 GMT
server: cloudflare
etag: "5c4b0534-b492"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z6ks5NTP5zOZXWfpydYE4FVnrN4ntO3z0C2FI0fg9K06HiKpDPxr3PlB4vZvx9X67JBXqB7KQmoaHPjAFY98WIdu%2FGuMx9KXEMyw31WAQNeeAMBPCqD3xhUt%2BD1WYMegia2yyjesUCU9K8bT2Qv7uwNOyzQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af598c314bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 step.png
create.cprewritten.net/img/ 370 B
1 KB 92ms
92ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/step.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dbfc26fb0423c757b81b04e48897b285c3336156c7aad7ddd9d68a72085befd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3669
cf-polished: origFmt=png, origSize=1648
content-disposition: inline; filename="step.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 370
last-modified: Fri, 25 Jan 2019 12:46:53 GMT
server: cloudflare
etag: "5c4b053d-670"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VPi3wpxyYQxIQBvFlnqT1zTepNdqwPAYh3NdOEOsonwQR8yM6qHYyyeEgDZbDTJ8P%2FbYpyplmlvP5mTANksT1SP%2F0ZQMgWJXDKhcXaSDS9GWK7SByFA6%2FFF7fQ%2BU3XeejjP6KL9S8PnCscIvcNTW01oVagw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af598c334bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 BurbankSmall-Bold.woff2
create.cprewritten.net/fonts/ 27 KB
28 KB 89ms
89ms Font
font/woff2 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://create.cprewritten.net/fonts/BurbankSmall-Bold.woff2

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bc24d1e2a739aca000b988f756e8bc4a41b84b0ce23acb6e1424dcda8cd1d2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://create.cprewritten.net/css/club_penguin.css
Origin: https://create.cprewritten.net
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3629
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27892
last-modified: Thu, 26 Apr 2018 22:47:55 GMT
server: cloudflare
etag: "5ae2571b-6cf4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xMs87M%2BaO6snNDEMcUREIkB0fJh1wF8oebAYF0jOVtSV5gznaacciUbHrg%2BBpuogsjG2EsfSIrNgdknHgwWVCveTTXYj6eqB1hdtfnCs3Yk8T9I6Ksv2rEBH5aR8tqzz6Egj7EYQub4oPHvnzr7N9CMwQXE%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
vary: Accept-Encoding
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af598c384bc5-YUL

GET
H3 200 button.png
create.cprewritten.net/img/ 114 B
778 B 83ms
82ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/button.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0f23c6a775e40ae8dcf69796cc55d408fd36fa643f24a856033f4290fa815b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3669
cf-polished: origFmt=png, origSize=331
content-disposition: inline; filename="button.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 114
last-modified: Fri, 25 Jan 2019 12:46:42 GMT
server: cloudflare
etag: "5c4b0532-14b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HFUCiTXf2JQ7%2BqYxw3UfNhE4wcHxe9xALIHL9kI1q9JIkmFG49tQOgMMqyoelk1QrgsSThDaTmTYFKigdXgsH2MlxgKfEqYaiLu7zsvnD3NoMTmC30B9lZTUdKOaGBj2Z55PKwlTEqPqmUVI3YQo6vZAxV0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af599c414bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 button-2.png
create.cprewritten.net/img/ 106 B
779 B 83ms
83ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/button-2.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd98da8fee398cdcab1a54304076757da835cd44f1823a4500efdc029d75375a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3629
cf-polished: origFmt=png, origSize=333
content-disposition: inline; filename="button-2.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 106
last-modified: Fri, 25 Jan 2019 12:46:42 GMT
server: cloudflare
etag: "5c4b0532-14d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lN%2BWkYZgeW0ogw8PcOTPp68%2F%2FI%2BwUFjqBVyhzbFN3VbmXAjf150HaMLIXTywrs30OqnKt991FXUvdV7dKUdXG8jpIoHuhYW6tsBx0DJq9zCYojteeHKpSAJMgeOIJWGcynvQj%2BJP6ZzZ9qdYvJ%2B4bMZLFPM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af599c424bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 ftr_repeat.jpg
create.cprewritten.net/img/ 110 B
794 B 83ms
83ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/ftr_repeat.jpg

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb4fa5337c5dc767801fff87e1fb4f3f8e224661372fba02f34796e6092da23e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3669
cf-polished: qual=85, origFmt=jpeg, origSize=832
content-disposition: inline; filename="ftr_repeat.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 110
last-modified: Fri, 25 Jan 2019 12:46:46 GMT
server: cloudflare
etag: "5c4b0536-340"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F%2Fajn3DMGBhflgX0KEIrcIHLwl8xK1b%2BzM%2FI8ihVIi4TBYWi1qV0Pm2J1IxF%2F4GdjF3USiB3JE9DuyKa68zFXyThJKjna0L02RNm2c6%2F8HyZNTl8vrTsQxM2rRPBWx8zW%2FD1T3hBwbZO7%2BgDyEY8DY5Qlz0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af599c444bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 ftr_bg.png
create.cprewritten.net/img/ 2 KB
3 KB 84ms
83ms Image
image/webp 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://create.cprewritten.net/img/ftr_bg.png

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e9beacadd4d9739f70e135ae205ba7590816ab29419b2b960198f424c87bd0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/css/club_penguin.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2849
cf-polished: origFmt=png, origSize=5371
content-disposition: inline; filename="ftr_bg.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2190
last-modified: Fri, 25 Jan 2019 12:48:48 GMT
server: cloudflare
etag: "5c4b05b0-14fb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tedzMwIwlTgTnidsL0f9dlBtukV8CLy2JWFg%2Bq%2BWbLKW7VlpDxVtjMbSuxPv1THucM2aIq1IAn4ueT716bnM24qIhsBQW%2FNAIADdKdaHhdkV47HYWnDCcyZOZwdOl0K%2BdfjuujAkGsxJfxjE2kydqs2wDjo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af599c454bc5-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 BurbankSmall-Medium.woff2
create.cprewritten.net/fonts/ 26 KB
27 KB 76ms
75ms Font
font/woff2 2606:4700:20::ac43:47f7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://create.cprewritten.net/fonts/BurbankSmall-Medium.woff2

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/css/club_penguin.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:47f7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db3f18838e57c528d21a6952d6513aea51f0ff4e1b19336f87078b14b4b71258

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://create.cprewritten.net/css/club_penguin.css
Origin: https://create.cprewritten.net
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:04 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3629
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 26536
last-modified: Thu, 26 Apr 2018 22:47:56 GMT
server: cloudflare
etag: "5ae2571c-67a8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Evt3Uvbk5geZT3bx5t6QkfPJXK1XMO7vicAcil15%2B7kVcOGD5ADNWyuxQyKDtLWrmriqACbUuItDk8uLstsnrEDaSJ%2BIR%2F0qWdNnYxiu4gYy8dUQ4LCcs5P3yRJ9dmX7846f%2FGFoEysbxNQydMJlMZpGtoo%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
vary: Accept-Encoding
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 6d98af59ac4f4bc5-YUL

GET
H3 200 main.min.js Show response
cmp.uniconsent.com/v2/ 124 KB
36 KB 62ms
34ms Script
application/javascript 2606:4700:3035::6815:20af
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.uniconsent.com/v2/main.min.js
Requested by: Host: cmp.uniconsent.com
URL: https://cmp.uniconsent.com/v2/69a34eb934/cmp.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:20af , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea70c5c9d05b9f7c28144502369ffb162aee76df1bf3f5708d31b188b328041b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 85149
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 02 Feb 2022 01:21:17 GMT
server: cloudflare
etag: W/"b46675281e38c9e9e60075a2f0358a04"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6gIV0%2BCoM8u7ZlJ40l77ZZyPHTqQm4VOioEOgAY1tqKVvi0cevxDqPm%2FfA6BHdz5fdTiKphmkwnRoriYQTyrDPgVPP2WwZbZBEMzRFYEv0xKSiUnRZlzSmfXGEtRKT01OHNaJ%2BZiDxXQdqKoLQJNWXg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400
cf-ray: 6d98af5a3e314bd7-YUL

GET
H3 200 config.json Show response
cmp.uniconsent.com/v2/69a34eb934/ 13 KB
3 KB 146ms
119ms Fetch
application/json 2606:4700:3035::6815:20af
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.uniconsent.com/v2/69a34eb934/config.json
Requested by: Host: cmp.uniconsent.com
URL: https://cmp.uniconsent.com/v2/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:20af , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21bc638b8af04d2ea121b63064dcd05649099bf2c0d994d8f32f47ed654cb599

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Thu, 27 Jan 2022 07:09:10 GMT
server: cloudflare
etag: W/"f69af4243e69ea6bae6e227b8f42e0bc"
x-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k8MCpZr41XkfpfY%2BgUTxZme0wkTSYTh8QB%2BWcqQSQzPXh3e%2B57Ck%2Bk%2BkqGFGoraIxX88aPe9cffsQsCwz2yybG2GV7qlEKrUwiHml7WIwE0nVP3BWRCTmveDNkCTpsldtasjY0Ofdn59YT9gpx1N3aY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d98af5aef5eecf2-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 hcaptcha-challenge.html Show response
newassets.hcaptcha.com/captcha/v1/f6912ef/static/ Frame 0910 2 KB
1 KB 49ms
37ms Document
text/html 104.16.168.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/f6912ef/static/hcaptcha-challenge.html

Requested by

Host: hcaptcha.com
URL: https://hcaptcha.com/1/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

861776560c222ad7345b5e2d93e0424beacda6169de7b10841043c8c5cad6b9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-type: text/html
last-modified: Tue, 01 Feb 2022 08:29:18 GMT
cache-control: max-age=1209600
x-cache: Hit from cloudfront
via: 1.1 a711a67257cff56fb6ecb34471f70906.cloudfront.net (CloudFront)
x-amz-cf-pop: YTO50-C3
x-amz-cf-id: yq8FPn0X6LCJQmdFeSO4uy12V6rnDsNgjAI2ZWnyMnG7wtDzPbGe5A==
age: 58643
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 6d98af5afdb3cacc-YYZ
content-encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 hcaptcha-checkbox.html Show response
newassets.hcaptcha.com/captcha/v1/f6912ef/static/ Frame 73AA 2 KB
1 KB 45ms
35ms Document
text/html 104.16.168.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/f6912ef/static/hcaptcha-checkbox.html

Requested by

Host: hcaptcha.com
URL: https://hcaptcha.com/1/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45d3881834cfd834f2794ea8116463c15817d18c45f43ddb953ec97d1d9f7599

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-type: text/html
last-modified: Tue, 01 Feb 2022 08:29:18 GMT
cache-control: max-age=1209600
x-cache: Hit from cloudfront
via: 1.1 98e73e5dcd76ade3e4aad5e1d1a53a02.cloudfront.net (CloudFront)
x-amz-cf-pop: YTO50-C3
x-amz-cf-id: DNkIyDGeUWgW5foYj6m-dvinKbSs4TqfmtqvZHnA3IVUvhIEFWfdUg==
age: 51143
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
strict-transport-security: max-age=2592000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 6d98af5afdadcacc-YYZ
content-encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 hcaptcha-checkbox.js Show response
newassets.hcaptcha.com/captcha/v1/f6912ef/ Frame 73AA 151 KB
47 KB 71ms
45ms Script
application/javascript 104.16.168.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/f6912ef/hcaptcha-checkbox.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/f6912ef/static/hcaptcha-checkbox.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

880b9925adaceae06bd88ed495a35f7b1beae2c4e10868a05d4d1672e14fb7fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://newassets.hcaptcha.com/captcha/v1/f6912ef/static/hcaptcha-checkbox.html
Origin: https://newassets.hcaptcha.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 58638
x-cache: Hit from cloudfront
strict-transport-security: max-age=2592000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 47889
access-control-allow-origin: *
last-modified: Tue, 01 Feb 2022 08:29:19 GMT
server: cloudflare
etag: "36958e84d9294f0674ab270708ec2758"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
via: 1.1 7a818cb34d4f96c0d6b48a1a51f766d0.cloudfront.net (CloudFront)
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding
cache-control: max-age=1209600
x-amz-cf-pop: YTO50-C3
accept-ranges: bytes
cf-ray: 6d98af5b6aec5443-YYZ
x-amz-cf-id: vQ3Lgstw7BcI4xVZNCSOkn_3g6AC-Hks7piBSW4vZv9cj7SGi00kcw==

GET
H3 200 hcaptcha-challenge.js Show response
newassets.hcaptcha.com/captcha/v1/f6912ef/ Frame 0910 206 KB
60 KB 54ms
29ms Script
application/javascript 104.16.168.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/f6912ef/hcaptcha-challenge.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/f6912ef/static/hcaptcha-challenge.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2fb54bf9e239e01290c830659528e9cfff3c2d5a203f42903ec2f552cec5e826

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://newassets.hcaptcha.com/captcha/v1/f6912ef/static/hcaptcha-challenge.html
Origin: https://newassets.hcaptcha.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 58643
x-cache: Hit from cloudfront
strict-transport-security: max-age=2592000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 60693
access-control-allow-origin: *
last-modified: Tue, 01 Feb 2022 08:29:19 GMT
server: cloudflare
etag: "d3675be9229b24fcdddf291a930c5aaa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
via: 1.1 123d46ccf974dd9f6866ee098beed414.cloudfront.net (CloudFront)
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding
cache-control: max-age=1209600
x-amz-cf-pop: YTO50-C3
accept-ranges: bytes
cf-ray: 6d98af5b6ae95443-YYZ
x-amz-cf-id: _hdZFoEAAINkjlYI87Jn74LtHHal93Tz7qpbiw42liZ5FKZufxJLFQ==

GET
H3 200 / Show response
cmp.uniconsent.com/json/ 67 B
609 B 114ms
114ms Fetch
application/json 2606:4700:3035::6815:20af
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.uniconsent.com/json/
Requested by: Host: cmp.uniconsent.com
URL: https://cmp.uniconsent.com/v2/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:20af , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e1bbf271152923fd231f7b12594af3c80dea516ea0af880f6c4a0fee8b8f514d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=boqlsSpm7zVwO97cfuUa0dPfhp14SpGe8%2BmLC3OzQIx1nOpIZQO3y0JbwvxMxArERo8EtPslwoFTW1rf1TFNhYE%2BSPDc8lxhzdjygacDbAL152yWvoeElPLOhXISVUEh3xXt7MwKpAscrjNIgpYwCXs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 6d98af5ba840ecf2-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
DATA 200
OK truncated
/ Frame 73AA 798 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 checksiteconfig Show response
hcaptcha.com/ Frame 73AA 508 B
858 B 90ms
89ms XHR
application/json 104.16.168.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hcaptcha.com/checksiteconfig?v=f6912ef&host=create.cprewritten.net&sitekey=77a19f73-4977-46ea-8989-9f73f3b778c5&sc=1&swa=1

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/f6912ef/hcaptcha-checkbox.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fdc1c7f6ecab7d070937be71c09d477a33653aaa916657906bbd1c4ce6c81557

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Cache-Control: no-cache
Referer: https://newassets.hcaptcha.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json; charset=utf-8

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
access-control-allow-headers: Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path
cf-chl-bypass: 2
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://newassets.hcaptcha.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-credentials: true
strict-transport-security: max-age=2592000; includeSubDomains; preload
cf-ray: 6d98af5cbdd45443-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

OPTIONS
H3 200 checksiteconfig
hcaptcha.com/ Frame 0
0 53ms
32ms Preflight 104.16.168.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hcaptcha.com/checksiteconfig?v=f6912ef&host=create.cprewritten.net&sitekey=77a19f73-4977-46ea-8989-9f73f3b778c5&sc=1&swa=1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: cache-control,content-type
Origin: https://newassets.hcaptcha.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-length: 0
access-control-allow-origin: https://newassets.hcaptcha.com
vary: Origin, Accept-Encoding
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path
access-control-allow-methods: GET, HEAD, POST, OPTIONS
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 6d98af5c7cd7542b-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 ads.js Show response
v3s8r2c3.stackpathcdn.com/ 140 B
356 B 85ms
28ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://v3s8r2c3.stackpathcdn.com/ads.js?a=1&ad_block=1
Requested by: Host: cmp.uniconsent.com
URL: https://cmp.uniconsent.com/v2/main.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: baae017ded2089d8c6173a41598210e58dc9d501966fa06916e92080cdba8623

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: gzip
last-modified: Thu, 24 Sep 2020 15:12:12 GMT
server: AmazonS3
etag: "b590bb023f189f4af7c50dc2454950d2"
x-cache-status: HIT
x-hw: 1644195665.cds061.dc2.hn,1644195665.cds076.dc2.c
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 141

GET
H3 200 vendor-list.json Show response
cmp.uniconsent.com/v2/ 304 KB
40 KB 120ms
119ms Fetch
application/json 2606:4700:3035::6815:20af
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.uniconsent.com/v2/vendor-list.json
Requested by: Host: cmp.uniconsent.com
URL: https://cmp.uniconsent.com/v2/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:20af , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79e19ced4ea473154f6ced4ec56a9ee7b57333dbd4b4dc8949adb6c9cc2e9d8e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 06 Feb 2022 19:10:02 GMT
server: cloudflare
etag: W/"67e057fa5d3b0e443146e458e4e7c060"
x-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h4jHPyHBck51Dz5tdrOewsdocdCXeeYRh5PHH6n4YBqOL7Y3vmS8ocF0miQpQ5mZ7t5HR48dfwIJNfp2OkPulCqjB8gjs3dWTRbukk47tAZ%2BibBiiG7ZJ%2F%2F0tkghdEUZg0vT7ywpIUeQ6He3TQ7iupg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6d98af5c691eecf2-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 hsw.js Show response
newassets.hcaptcha.com/c/9449fda8/ Frame 0910 919 KB
347 KB 31ms
30ms Script
application/javascript 104.16.168.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/c/9449fda8/hsw.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/f6912ef/hcaptcha-challenge.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.168.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bcc4290f7041ce142b6f5142eccb9c47c8ad59c1e8142361b7d40659fcd59f9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://newassets.hcaptcha.com/captcha/v1/f6912ef/static/hcaptcha-challenge.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
via: 1.1 5a013b4ab55713f92a97f8f6e5bb3caa.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
age: 29075
x-cache: Hit from cloudfront
content-encoding: gzip
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 04 Feb 2022 16:51:49 GMT
server: cloudflare
etag: W/"777d618166357c7ea8c00b987c3ad278"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains; preload
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=1209600
x-amz-cf-pop: YTO50-C3
cf-ray: 6d98af5d4f2a5443-YYZ
x-amz-cf-id: PskiU8un-CxxYU9E-ebxfKdOi2L9ZS4giyXiykeSiBjdn-ZqHbF3oA==

GET
H2 200 j-cprewrittennet_new.min.js Show response
dsh7ky7308k4b.cloudfront.net/publishers/ 1 KB
965 B 82ms
20ms Script
application/javascript 54.230.244.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dsh7ky7308k4b.cloudfront.net/publishers/j-cprewrittennet_new.min.js
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.244.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-244-60.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 15ff3339fbfa4a01753f5df31da2c59535feb4841d1e6d9cd9de66ada3fd0608

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 14:08:09 GMT
content-encoding: br
age: 1507977
x-cache: Hit from cloudfront
x-amz-meta-ctime: 1642687629
x-amz-meta-mode: 33188
last-modified: Thu, 20 Jan 2022 14:07:10 GMT
server: AmazonS3
etag: W/"fd576162950e0c7137a62f4dc157cb32"
x-amz-meta-uid: 1004
vary: Accept-Encoding
x-amz-meta-gid: 1004
via: 1.1 34deee8ac34d726c1404a3045667664a.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
content-type: application/javascript
x-amz-cf-id: P9fVO2wOmFCCmpWs0UAHmqUS6yyzEZ0JeK8Na4BzSYdO0gckCuOltQ==
x-amz-meta-atime: 1636539024
x-amz-meta-mtime: 1642687629

GET
H2

200

tag Show response
btloader.com/
Redirect Chain

https://pubgalaxy-com.videoplayerhub.com/gallery.js
https://btloader.com/tag?h=pubgalaxy-com&upapi=true

15 KB
6 KB

77ms
25ms

Script
application/javascript

2606:4700:20::ac43:4686
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?h=pubgalaxy-com&upapi=true
Protocol: H2
Server: 2606:4700:20::ac43:4686 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82662a87235401465037f108b69c322f8d2edadf5915ea8dd16359cea4d01012

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

cf-ray: 6d98af5e7bf97142-YUL
date: Mon, 07 Feb 2022 01:01:05 GMT
via: 1.1 google
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2606
etag: W/"1fc853ce30e94aefdb4f9bd8bed0518c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E78B9SITHbRe1C%2FJkyVrXIT3636RBVrmKmToQ8YYnxRkFpnTKQYv1iI3gDp0vYeoLILL6D134RfDtdeQX0gUgcteXfNdf0pFIr%2FvSc4GO4JohzbjC33vMe8ZDxFqUeiVj7pA9u9Ni3oSJw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800, must-revalidate
content-encoding: br

Redirect headers

date: Mon, 07 Feb 2022 01:01:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O2lhuTgqn9qKiQ2xOl0lOOTFTdET9Ijc%2FQQN5RYBl5Fbx%2BggHm%2BRyQolhooiQEL7Imo8EEmBIQkZRvuewojZMAF4gziKYKTpgrsDIo1alKyB4hMK8MGIp4yCp9VjR02odBrC1fCxGJadTniEJxz2PrSmvqdIK%2BnMv3osUMkW"}],"group":"cf-nel","max_age":604800}
location: https://btloader.com/tag?h=pubgalaxy-com&upapi=true
cache-control: max-age=3600
cf-ray: 6d98af5ddfbf7148-YUL
expires: Mon, 07 Feb 2022 02:01:05 GMT

GET
H2 200 j-cprewrittennet_CFG1_default_new.min.js Show response
dsh7ky7308k4b.cloudfront.net/publishers/abtestwrappers/ 393 KB
149 KB 24ms
23ms Script
application/javascript 54.230.244.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dsh7ky7308k4b.cloudfront.net/publishers/abtestwrappers/j-cprewrittennet_CFG1_default_new.min.js
Requested by: Host: dsh7ky7308k4b.cloudfront.net
URL: https://dsh7ky7308k4b.cloudfront.net/publishers/j-cprewrittennet_new.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.244.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-244-60.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 507c5dcb8f3ea14bbff51e396fa24c53070dd7fdd105bcbecb4e7251c855b419

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 20 Jan 2022 14:08:22 GMT
content-encoding: br
age: 1507964
x-cache: Hit from cloudfront
x-amz-meta-ctime: 1642687628
x-amz-meta-mode: 33188
last-modified: Thu, 20 Jan 2022 14:07:09 GMT
server: AmazonS3
etag: W/"d8967c2c33f4f7fcb62e21a9228edc7c"
x-amz-meta-uid: 1004
vary: Accept-Encoding
x-amz-meta-gid: 1004
via: 1.1 34deee8ac34d726c1404a3045667664a.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-P1
content-type: application/javascript
x-amz-cf-id: nOcvy_DZOSLrYTES6xDpsYkFCiFA97NonOxUUi1wzB7CQq8s-u3Fzg==
x-amz-meta-atime: 1642687628
x-amz-meta-mtime: 1642687628

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
664 B 71ms
22ms Image
image/x-icon 142.251.40.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 06 Feb 2022 05:04:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71823
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0
last-modified: Tue, 08 May 2012 13:08:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 07 Feb 2022 05:04:02 GMT

GET
H2 200 px.gif
ad-delivery.net/ 43 B
939 B 83ms
26ms Image
image/gif 2606:4700:20::ac43:4513
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.6303217746883631
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
date: Mon, 07 Feb 2022 01:01:05 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 563
x-guploader-uploadid: ADPycdupfa7KCtOe0TVtQ1XEXjEqBcYS55h5xltmciWkwyT05QVbX3hl2G6BY1wwXXVxP-9l4WeFTPgHVnUrgCoq0nDtipi3Jg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-type: image/gif
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s4wg7xqAcbqk9CcjLk8NlFjxduMPRK%2BPJ1vgUBq2yRpYHR2ObtEwi4ZwoewBCPDGk9CtLWolBP9iVARJBOuRVEJt6IVyeoqF0%2Fvqz18KsNuqtaBVD%2B%2FqJ76pDiF0DiEDJ5yoouCrU0d4%2FuL6vg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1620242732037093
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=86400
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 6d98af5f0a43714b-YUL
expires: Mon, 07 Feb 2022 01:31:23 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 631ms
96ms Preflight
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fcreate.cprewritten.net%2F&domain=create.cprewritten.net&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://create.cprewritten.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
access-control-allow-origin: https://create.cprewritten.net
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1659
date: Mon, 07 Feb 2022 01:01:05 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
27 KB 91ms
44ms Script
text/javascript 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5efaa403a369560500d97b80168dc33ad226fa7ce9b6f62c50f77c68bb9a6b36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27219
x-xss-protection: 0
server: sffe
etag: "1124 / 181 of 1000 / last-modified: 1644015869"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 07 Feb 2022 01:01:05 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 134 KB
36 KB 74ms
20ms Script
application/javascript 54.239.200.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.239.200.177 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-239-200-177.ewr53.r.cloudfront.net
Software: Server /
Resource Hash: c7360a9b46fde11845b3090ca0034fb409d92398a71f3ae15fac3a2fa29ae6cc

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 06 Feb 2022 23:10:02 GMT
content-encoding: gzip
age: 6662
x-cache: Hit from cloudfront
timing-allow-origin: *
server: Server
x-amz-rid: 0NH59Y91HKFHDWMQ0ZPQ
etag: a89a0f9aa62d9c46ee287cd1f0b6423d
vary: Accept-Encoding
x-amz-version-id: GzCVpXkwVbKPnWWiNgpDCABi9Jbs4BMI
via: 1.1 6f9ef5ae165c9835aa6935d9fb7e2072.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: EWR53-P1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: UgqN0XPzVp8OF6Z1E2w0kgNjwWpBUvtBvZFFwOccFt60nOdElHkVuw==

GET
H2 200 localstore.js Show response
script.4dex.io/ 483 B
948 B 86ms
27ms Script
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 986979
x-amz-request-id: tx412e9c28221a4f3f86dcd-0061f15fee
x-amz-id-2: tx412e9c28221a4f3f86dcd-0061f15fee
last-modified: Wed, 26 Jan 2022 14:43:29 GMT
server: cloudflare
etag: W/"922cffdd75f7192f75231d92684885aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pz9%2Bkl8epzvncy5HZ%2FIEjF%2BIVFmjgjMbZ88iLhZ3lwLlX45PkBMgJ7FnughOWz8ZIzTk497bHlW%2F%2Fs4tSn7Wiwn2s5jhE3I1hjZKUv0uwYxGmGS%2F%2B%2FcWEULcttXCfJbdZAZte85LIogOQ5PI"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
x-amz-version-id: 1643208209303360
cf-ray: 6d98af5faefa4bbf-YUL

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fcreate.cprewritten.net%2F&domain=create.cprewritten.net&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=qzkfsHwySnU2amNRMnoyNHgydFcveXRpU1NTWDBiTU1EWFQrMTFXZTE0aWk3RDFKVEs5YTQvc1YrWTZhMk50ZG1SOGRoMm5ISHFyMUxDd2Qyc0tIWldSamdVczJrdmw4QmxnQmtoRk9LN0E0anlHRVNxdHVsZm9DRGhNV0...

337 B
610 B

74ms
27ms

XHR
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=qzkfsHwySnU2amNRMnoyNHgydFcveXRpU1NTWDBiTU1EWFQrMTFXZTE0aWk3RDFKVEs5YTQvc1YrWTZhMk50ZG1SOGRoMm5ISHFyMUxDd2Qyc0tIWldSamdVczJrdmw4QmxnQmtoRk9LN0E0anlHRVNxdHVsZm9DRGhNV0hUZnZkc1FWZ0Y2Z3FsVXdSQzJUUlpmQVBVczI3TnRyWExFelRkS1l1UGk4N3hjYXoyQ1Fjc3JMTFNWWlFCQVVvcXA2UHI4VW9yZkZ6ZHpVbXJxVlpPd1V1VGMxMStuditIVUl4ZFF3NXUvbVpNb0JZV2tpWWxJR1EvMndhblVrcXNGczh1aWVGfA&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

330efe4a94910eee09cb27d130c5bca7b070eedb49b4d75cc3e29d2dbb55f787

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3730
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:05 GMT
location: https://mug.criteo.com/sid?cpp=qzkfsHwySnU2amNRMnoyNHgydFcveXRpU1NTWDBiTU1EWFQrMTFXZTE0aWk3RDFKVEs5YTQvc1YrWTZhMk50ZG1SOGRoMm5ISHFyMUxDd2Qyc0tIWldSamdVczJrdmw4QmxnQmtoRk9LN0E0anlHRVNxdHVsZm9DRGhNV0hUZnZkc1FWZ0Y2Z3FsVXdSQzJUUlpmQVBVczI3TnRyWExFelRkS1l1UGk4N3hjYXoyQ1Fjc3JMTFNWWlFCQVVvcXA2UHI4VW9yZkZ6ZHpVbXJxVlpPd1V1VGMxMStuditIVUl4ZFF3NXUvbVpNb0JZV2tpWWxJR1EvMndhblVrcXNGczh1aWVGfA&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://create.cprewritten.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1785
content-length: 509
expires: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
120 B 181ms
122ms XHR
text/plain 104.36.115.111
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://create.cprewritten.net
date: Mon, 07 Feb 2022 01:01:04 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 27 KB
27 KB 198ms
125ms XHR
application/json 104.94.205.31
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=430256&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%225125867030e457%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fcreate.cprewritten.net%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A3%2C%22ren%22%3Afalse%2C%22version%22%3A%224.42.1%22%2C%22userIds%22%3A%5B%5D%2C%22msd%22%3A6%2C%22msi%22%3A6%7D%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pubgalaxy.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%2213014%22%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%2C%22us_privacy%22%3A%221---%22%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%226618156e92046a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22430256%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2273fe4e4987bd9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22430260%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%228d66f5d101580b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22656721%22%2C%22sid%22%3A%22320x50%22%7D%2C%22banner%22%3A%7B%22w%22%3A320%2C%22h%22%3A50%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%226618156e92046a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22430256%22%2C%22sid%22%3A%22728x68%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A68%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%226618156e92046a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22430256%22%2C%22sid%22%3A%22468x60%22%7D%2C%22banner%22%3A%7B%22w%22%3A468%2C%22h%22%3A60%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%226618156e92046a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22430256%22%2C%22sid%22%3A%22468x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A468%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2273fe4e4987bd9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22430260%22%2C%22sid%22%3A%22468x60%22%7D%2C%22banner%22%3A%7B%22w%22%3A468%2C%22h%22%3A60%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2273fe4e4987bd9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22430260%22%2C%22sid%22%3A%22728x68%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A68%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2273fe4e4987bd9%22%2C%22ext%22%3A%7B%22siteID%22%3A%22430260%22%2C%22sid%22%3A%22468x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A468%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.94.205.31 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-94-205-31.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: f7a2ddc79a1065b0e033d091074beb26790c41616ab27ffeb4290868c245a15e

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
x-ak-initial-geo: CC:[CA], RC:[QC], CN:[NA], CIP:[149.56.153.181], XFF:[]
server: Apache
content-type: application/json
access-control-allow-origin: https://create.cprewritten.net
x-cs-client-geo: 19
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 27641
x-ak-client-geo: 19
expires: Mon, 07 Feb 2022 01:01:06 GMT

GET
H2 200 arj Show response
pubgalaxy-d.openx.net/w/1.0/ 188 B
607 B 72ms
35ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pubgalaxy-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fcreate.cprewritten.net%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=a26b3b53-1341-4dbc-8e3b-4553c7940cb6%2Cedfef193-8293-42a5-b551-0372f1eabeaf%2Ce81439c9-0f80-4516-8d20-b09265862147&nocache=1644195665821&gdpr=0&us_privacy=1---&schain=1.0%2C1!pubgalaxy.com%2C13014%2C1%2C%2C%2C&aus=728x90%2C728x68%2C468x60%2C468x90%7C468x60%2C728x68%2C468x90%2C728x90%7C320x50&divids=div-gpt-ad-cprewrittennet36420%2Cdiv-gpt-ad-cprewrittennet36423%2Cdiv-gpt-ad-cprewrittennet36430&aucs=div-gpt-ad-cprewrittennet36420%2Cdiv-gpt-ad-cprewrittennet36423%2Cdiv-gpt-ad-cprewrittennet36430&auid=541159796%2C556397784%2C556397834&aumfs=10%2C10%2C10
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 7d4aa474e57a246409811e350d851b91e23146b019d91774274a5920046ffee7

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: gzip
server: OXGW/17.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://create.cprewritten.net
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 175
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 563 B
2 KB 133ms
50ms XHR
application/json 69.166.1.14
AS-XFERNET

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2214abd37f1658eff%22%3A%2292be6199286372514820%7C728x90%2C728x68%2C468x60%2C468x90%7Cgpid%3Ddiv-gpt-ad-cprewrittennet36420%22%2C%221541fa0d96c898%22%3A%224390f2e77fa8e72e655e%7C468x60%2C728x68%2C468x90%2C728x90%7Cgpid%3Ddiv-gpt-ad-cprewrittennet36423%22%2C%221682c55cd1d8b6a%22%3A%2232b761fdcf0d6c91a270%7C320x50%7Cgpid%3Ddiv-gpt-ad-cprewrittennet36430%22%7D&ref=https%3A%2F%2Fcreate.cprewritten.net%2F&s=dc88673a-1c79-4d6f-b360-56addb9039e7&pv=473afbb3-883e-4141-984b-73047924f371&vp=desktop&lib_name=prebid&lib_v=4.42.1&us=3&ius=0&gdpr=false&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pubgalaxy.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%2213014%22%7D%5D%7D&us_privacy=1---&coppa=0

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.14 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8eb956c960668e4fbd460a7d422ef980746324ba0e2e1b54c1997072c00cfe33

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:05 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-51
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://create.cprewritten.net
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 386
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
342 B 223ms
142ms XHR
application/json 3.230.217.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96954f01747430358b36682557033a&pos=5156800&cmd=bid&secure=1&us_privacy=1---
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-230-217-116.compute-1.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: c54b0c715144b3f1d66b384be585c1678ab926f88df07aa28ac76ff6183113a0

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
server: ATS/9.1.0.33
age: 1
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://create.cprewritten.net
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
344 B 206ms
125ms XHR
application/json 3.230.217.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96954f01747430358b36682557033a&pos=5156860&cmd=bid&secure=1&us_privacy=1---
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-230-217-116.compute-1.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: d2e3a8eb5eff236a21a954970c9d684413f93ef9e31027dbf75c0ee3eae28f81

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
server: ATS/9.1.0.33
age: 1
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://create.cprewritten.net
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
548 B 184ms
103ms XHR
application/json 3.230.217.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96954f01747430358b3668267c033c&pos=5156795&cmd=bid&secure=1&us_privacy=1---
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-230-217-116.compute-1.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: c6b3ed331ae7f65aec24028af73c35466ae984ab3c2e2c834e74eb122cfc452b

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
server: ATS/9.1.0.33
age: 1
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://create.cprewritten.net
access-control-allow-credentials: true
content-length: 62

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
369 B 37ms
9ms XHR
application/json 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip186.ip-51-222-39.net

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://create.cprewritten.net
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H2 200 ROS Show response
ads.us.e-planning.net/pbjs/1/3b07e/1/create.cprewritten.net/ 2 B
162 B 90ms
25ms XHR
text/plain 172.98.26.125
E-PLANNING-

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/pbjs/1/3b07e/1/create.cprewritten.net/ROS?rnd=0.023356640152213393&e=178925%3A728x90%2C728x68%2C468x60%2C468x90%2B178934%3A728x90%2C468x60%2C728x68%2C468x90%2B178922%3A320x50&ur=https%3A%2F%2Fcreate.cprewritten.net%2F&pbv=4.42.1&ncb=1&vs=FFF&crs=UTF-8&fr=https%3A%2F%2Fcreate.cprewritten.net%2F&gdpr=0&ccpa=1---
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.98.26.125 Ashburn, United States, ASN399668 (E-PLANNING-, US),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://create.cprewritten.net
date: Mon, 07 Feb 2022 01:01:05 GMT
access-control-allow-credentials: true
server: openresty
content-type: text/plain
content-length: 2
x-sid: IAD-1223

GET
H2 200 / Show response
adx.adform.net/adx/ 15 B
492 B 662ms
157ms XHR
application/json 37.157.5.142
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/?rp=4&bWlkPTEwNjU0NTgmcHJpY2VUeXBlPW5ldCZ0cmFuc2FjdGlvbklkPWEyNmIzYjUzLTEzNDEtNGRiYy04ZTNiLTQ1NTNjNzk0MGNiNiZyY3VyPVVTRA%3D%3D&bWlkPTEwNzY4OTcmcHJpY2VUeXBlPW5ldCZ0cmFuc2FjdGlvbklkPWVkZmVmMTkzLTgyOTMtNDJhNS1iNTUxLTAzNzJmMWVhYmVhZiZyY3VyPVVTRA%3D%3D&bWlkPTEwNzcwMDgmcHJpY2VUeXBlPW5ldCZ0cmFuc2FjdGlvbklkPWU4MTQzOWM5LTBmODAtNDUxNi04ZDIwLWIwOTI2NTg2MjE0NyZyY3VyPVVTRA%3D%3D&pt=net&stid=201f5a63-9cd1-4c01-b1a1-556609164e21&gdpr=0&gdpr_consent=undefined&us_privacy=1---&fd=1

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.5.142 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

631bc9fa39ddcdd4008398e649671ba79db3cc7c1725d7b8cd9823ec243f0a48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://create.cprewritten.net
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H2 204 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ 0
153 B 529ms
26ms XHR
text/plain 2606:ae80:1471:16::820
VALUECLICK

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:ae80:1471:16::820 , United States, ASN25751 (VALUECLICK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://create.cprewritten.net
pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: 0

POST
H2 200 adjson Show response
ads.betweendigital.com/ 2 B
918 B 639ms
141ms XHR
application/json 88.212.252.22
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.betweendigital.com/adjson?t=prebid
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 88.212.252.22 , Russian Federation, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://create.cprewritten.net
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json

POST
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
203 B 149ms
97ms XHR
text/plain 54.165.215.84
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.215.84 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-165-215-84.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://create.cprewritten.net
Date: Mon, 07 Feb 2022 01:01:05 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

POST
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
203 B 134ms
82ms XHR
text/plain 54.165.215.84
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.215.84 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-165-215-84.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://create.cprewritten.net
Date: Mon, 07 Feb 2022 01:01:05 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

POST
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
203 B 149ms
97ms XHR
text/plain 54.165.215.84
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.165.215.84 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-165-215-84.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://create.cprewritten.net
Date: Mon, 07 Feb 2022 01:01:05 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 37 KB
14 KB 426ms
386ms XHR
application/json 68.67.179.113
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.113 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

18e2821dc02514cb83a1761847d55152155eeea90516da0f0e92922ea7b52f7b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 9d13c326-1391-457f-b7aa-77064d1733ca
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://create.cprewritten.net
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 13 KB
8 KB 299ms
260ms XHR
application/json 68.67.179.113
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.113 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

bidder.va1.vip.prod.criteo.com

Software

nginx/1.17.9 /

Resource Hash

3f5242b2a88d0073385d87855d7df3d72e4ba80f52739c83f18dcf4449bf8994

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 2656c561-cf54-457a-8ed7-80ff6426f8af
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://create.cprewritten.net
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
319 B 103ms
44ms XHR
application/json 74.119.119.129
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.42.1&cb=25465901523

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://create.cprewritten.net
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 prebid Show response
mp.4dex.io/ 3 KB
1 KB 204ms
153ms XHR
application/json 2606:4700::6812:272
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:272 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f185773d4b0d73fe1d80fa3ed11562d7ddbe55434ea7daf0662a982305b07f3

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-origin: https://create.cprewritten.net
content-length: 876
x-err: Validating the Prebid Request adunits. Sampled or No valid non-debug AdUnits
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 6d98af5feb6c4bc5-YUL
expires: 0

GET
H2 204 pv Show response
api.btloader.com/ 0
96 B 83ms
45ms XHR
text/plain 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/pv?tid=UGvIQsXo&w=5737501945757696&o=5184339635601408&cv=2.0.2-2-gfdc9054&r=false&pageURL=https%3A%2F%2Fcreate.cprewritten.net%2F&upapi=true
Requested by: Host: pubgalaxy-com.videoplayerhub.com
URL: https://pubgalaxy-com.videoplayerhub.com/gallery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 07 Feb 2022 01:01:05 GMT
cache-control: no-cache, no-store, must-revalidate
vary: Origin
alt-svc: clear
via: 1.1 google

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 619 B
979 B 51ms
49ms XHR
application/json 54.239.200.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fcreate.cprewritten.net&pubid=6d0c7ea7-f036-437d-be93-21fc59c890c2
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.239.200.177 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-239-200-177.ewr53.r.cloudfront.net
Software: Server /
Resource Hash: 33685e0552d6dde5163a22558998f88807afbbac4df14efac987cdbcaff4144f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 00:00:35 GMT
via: 1.1 6f9ef5ae165c9835aa6935d9fb7e2072.cloudfront.net (CloudFront)
server: Server
age: 3629
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://create.cprewritten.net
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-pop: EWR53-P1
content-length: 619
x-amz-cf-id: 4KmzDbTsnLm0B2YQ6HLPMjItcm8QNB-rWOFsWcffoc9f2NuAYr2Xzg==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 58ms
21ms XHR
application/javascript 54.239.200.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.239.200.177 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-239-200-177.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 06 Feb 2022 17:37:21 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 26625
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Fri, 21 Jan 2022 02:54:57 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: eaU6ir6qmGswM2SGRmLi7PKhBcBrRdvn
via: 1.1 3c5c6d0ac004d7cc9b79e2835fc1f6a4.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: EWR53-P1
content-type: application/javascript
x-amz-cf-id: XUhE_L6qgG2XHBT8w2jOHFaLpRBNWUZcp9yKVdEmF1pNwIUFOQEfTg==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 226 B
700 B 270ms
269ms XHR
text/javascript 54.239.200.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fcreate.cprewritten.net%2F&pid=HN9gQdq9VzyKG&cb=0&ws=1600x1200&v=7.72.0&t=2000&slots=%5B%7B%22sd%22%3A%22div-gpt-ad-cprewrittennet36420%22%2C%22s%22%3A%5B%22728x90%22%2C%22728x68%22%2C%22468x60%22%2C%22468x90%22%5D%2C%22sn%22%3A%22%2F8095840%2C21857562343%2F.2_A.36420.3_j-cprewritten.net_tier1%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-cprewrittennet36423%22%2C%22s%22%3A%5B%22468x60%22%2C%22728x68%22%2C%22468x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F8095840%2C21857562343%2F.2_A.36423.3_j-cprewritten.net_tier1%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-cprewrittennet36430%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22sn%22%3A%22%2F8095840%2C21857562343%2F.2_A.36430.5_j-cprewritten.net_tier1%22%7D%5D&schain=1.0%2C1!pubgalaxy.com%2C13014%2C1%2C%2C%2C&pubid=6d0c7ea7-f036-437d-be93-21fc59c890c2&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%2C%22cmpTimeout%22%3A10000%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.239.200.177 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-239-200-177.ewr53.r.cloudfront.net

Software

Server /

Resource Hash

27b82ec8ca5b37b7b6279edadf6cf5ecfea73663e56f8f8299b76e11e7620d7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
via: 1.1 6f9ef5ae165c9835aa6935d9fb7e2072.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: EWR53-P1
x-amz-rid: K9K0GYDQB0EBBK56K5VK
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://create.cprewritten.net
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 226
x-amz-cf-id: 1JY1j3iydQ63iX-G3oHtFkU7eSod6cu39X47IPc8lFLSvNnWwh5qDQ==

GET
H3 200 pubads_impl_2022020101.js Show response
securepubads.g.doubleclick.net/gpt/ 351 KB
119 KB 48ms
20ms Script
text/javascript 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020101.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b1ad18d59a923a30397279d4545c15ae7088bb6e70f37b6468b890fc4cfee8ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 00:03:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3447
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 121756
x-xss-protection: 0
last-modified: Tue, 01 Feb 2022 09:38:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 07 Feb 2023 00:03:38 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 125 B
128 B 66ms
38ms XHR
application/json 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=create.cprewritten.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f32249842b226ffa3135e0a502aaae4930499e90a1d657fd8fc571f116d1e514

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 103
x-xss-protection: 0
expires: Mon, 07 Feb 2022 01:01:05 GMT

GET
H2 200 adagio.js Show response
script.4dex.io/ 71 KB
23 KB 89ms
45ms Fetch
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7447c1664f6a06328cd895a4914acad40ad47827ebe00becbd570138ff7e785c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:05 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 986057
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: tx8308ed0eb66e4156a3278-0061f15ff7
x-amz-id-2: tx8308ed0eb66e4156a3278-0061f15ff7
last-modified: Wed, 26 Jan 2022 14:43:28 GMT
server: cloudflare
etag: W/"88567a823cfd2840dd0a3198b929d466"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DrmUPb40sXc%2BTomY01pbK4V4CXpXU92X7AbKK1LN7QGtcDDTmvBFB48UggcZWL4YblDJVc%2FWNgVc0CpRimOIsHN5Kf7xeYq%2BrPKb25hdU5sxOJl7wsrs05DNofPQO4ohhIghqQa%2FV9U8Rf9f"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1643208208262354
cf-ray: 6d98af603d05ca67-YUL
access-control-allow-headers: Authorization

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 53 KB
17 KB 433ms
26ms Script
application/javascript 23.57.131.233
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.131.233 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-131-233.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-encoding: gzip
last-modified: Tue, 01 Jun 2021 17:06:57 GMT
server: Apache
etag: "d398-5c3b75e9ebb41-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17087
expires: Mon, 07 Feb 2022 01:16:06 GMT

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 38 KB
11 KB 418ms
18ms Script
text/javascript 46.105.202.126
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

46.105.202.126 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

60d76e5d3d47c3f67063f6ad8c4c19906031164734d901e60a8842d0a292a1cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
x-cacheable: Matched cache
x-cdn-pop-ip: 137.74.122.0/26
date: Mon, 07 Feb 2022 00:39:47 GMT
content-type: text/javascript;charset=utf-8
cache-control: max-age=3600
x-cdn-pop: bhs
content-disposition: attachment;filename="id5-api.js"
accept-ranges: bytes
content-length: 10638
x-request-id: 960987611

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 5DCA 2 KB
814 B 10ms
10ms Document
text/html 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=6b859b96c564fbe

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip186.ip-51-222-39.net

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame 50F7
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t

348 B
1 KB

46ms
46ms

Document
text/html

209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

4cb0dd66deb87098df15c940dba7fbd6fdc8ec7962d2b83c6f436af7565cd0e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/

Response headers

Server: Server
Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 348
Connection: keep-alive
x-amz-rid: WZ0F0HP0Q897HHB8KXNN
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

Server: Server
Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Length: 0
Connection: keep-alive
x-amz-rid: JDKD1BP528EB8701BZ8V
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

POST
H/1.1 200 341.json Show response
id5-sync.com/g/v2/ 2 KB
2 KB 400ms
98ms XHR
application/json 51.195.5.232
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/341.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.195.5.232 , France, ASN16276 (OVH, FR),

Reverse DNS

p15.id5-sync.com

Software

Resource Hash

6e8accc09b1996122c957c186712edbc8209c445c555da6216142e7461fbfb13

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 07 Feb 2022 01:01:06 GMT
Vary: Origin
P3P: CP="CAO PSA OUR"
Access-Control-Allow-Origin: https://create.cprewritten.net
Access-Control-Allow-Credentials: true
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8
Transfer-Encoding: chunked

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame 3445 3 KB
4 KB 28ms
27ms Document
text/html 209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

97d0f25bd348e0d298c8d171ed6e37edfcd4f2eef214b1089b469c44abcd8a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&dcc=t

Response headers

Server: Server
Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 3278
Connection: keep-alive
x-amz-rid: 8BMMC902MNRVB3YTGCKF
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 93ms
40ms Script
application/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=create.cprewritten.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Feb 2022 01:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
8 KB 339ms
338ms XHR
text/plain 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1909829915837632&correlator=1551268105322592&output=ldjh&impl=fif&eid=31060837%2C31063871%2C31064660%2C21064372&vrg=2022020101&ptt=17&gdpr=0&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20220207&iu_parts=8095840%3A21857562343%2C.2_A.36420.3_j-cprewritten.net_tier1&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C728x68%7C468x60%7C468x90&prev_scp=amznbid%3D2%26amznp%3D2%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D728x90%26hb_pb%3D0.88%26hb_adid%3D61ea0bf4e38ed3f%26hb_bidder%3Dix&eri=1&cust_params=wrapper_active%3D845defd5-3b77-4686-9372-0804d9f9aa3d&cookie_enabled=1&bc=31&abxe=1&dt=1644195666520&lmt=1644195666&dlt=1644195664729&idt=1276&frm=20&biw=1600&bih=1200&oid=2&adxs=436&adys=212&adks=937356322&ucis=1&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&url=https%3A%2F%2Fcreate.cprewritten.net%2F&vis=1&scr_x=0&scr_y=0&psz=840x90&msz=728x-1&ga_vid=894113972.1644195667&ga_sid=1644195667&ga_hid=353468230&ga_fc=false&fws=4&ohw=906&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b73b90c9673eedb3cf4895f653b3a73fdf8e3b52f71e9e13ed7c3150c5679076

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8045
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://create.cprewritten.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 19 KB
9 KB 682ms
682ms XHR
text/plain 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1909829915837632&correlator=1551268105322592&output=ldjh&impl=fif&eid=31060837%2C31063871%2C31064660%2C21064372&vrg=2022020101&ptt=17&gdpr=0&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20220207&iu_parts=8095840%3A21857562343%2C.2_A.36423.3_j-cprewritten.net_tier1&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60%7C728x68%7C468x90%7C728x90&prev_scp=amznbid%3D2%26amznp%3D2%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D468x60%26hb_pb%3D1.50%26hb_adid%3D66c84454dff612%26hb_bidder%3Dappnexus&eri=1&cust_params=wrapper_active%3D845defd5-3b77-4686-9372-0804d9f9aa3d&cookie_enabled=1&bc=31&abxe=1&dt=1644195666526&lmt=1644195666&dlt=1644195664729&idt=1276&frm=20&biw=1600&bih=1200&oid=2&adxs=436&adys=953&adks=887187448&ucis=2&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&url=https%3A%2F%2Fcreate.cprewritten.net%2F&vis=1&scr_x=0&scr_y=0&psz=840x90&msz=728x-1&ga_vid=894113972.1644195667&ga_sid=1644195667&ga_hid=353468230&ga_fc=false&fws=4&ohw=906&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bbdf8f53ae29dbff7df016ed2ab6ed304d8ae336b97211be8a13ad5c0c1d5ff7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8834
x-xss-protection: 0
google-lineitem-id: 5713178128
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138352069911
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://create.cprewritten.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 101ms
46ms XHR
application/json 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022020101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

64f52c33b49db9995dba351d3592e5685e837ec912cb1b4705d0a216251128c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Feb 2022 01:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9811
x-xss-protection: 0

GET
H2 200 container.html Show response
49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E128 6 KB
4 KB 109ms
34ms Document
text/html 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 07 Feb 2022 01:01:06 GMT
expires: Tue, 07 Feb 2023 01:01:06 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 204 /
s.ad.smaato.net/c/ Frame 3445 0
240 B 83ms
18ms Image
text/plain 2600:9000:2209:de00:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2209:de00:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
via: 1.1 35c803afef083002d824403342d4c62e.cloudfront.net (CloudFront)
server: CloudFront
cache-control: no-cache, must-revalidate
x-amz-cf-pop: EWR53-P1
x-amz-cf-id: Bdd0zgc8zqsnXqATN-GGIqrpmrjTcpXRSt8E4VIYiepRk7f0CDP66w==
x-cache: FunctionGeneratedResponse from cloudfront

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 3445
Redirect Chain

https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D?gdpr=0
https://s.amazon-adsystem.com/ecm3?id=9A300A08850D4F8E9BE6AC768CE8B8A1&ex=simpli.fi&status=ok

43 B
556 B

46ms
29ms

Image
image/gif

209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=9A300A08850D4F8E9BE6AC768CE8B8A1&ex=simpli.fi&status=ok

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0

Protocol

HTTP/1.1

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: ESRHN8WF78Z2Z8478ZN2
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Mon, 07 Feb 2022 01:01:06 GMT
x-content-type-options: nosniff
server: nginx
location: https://s.amazon-adsystem.com/ecm3?id=9A300A08850D4F8E9BE6AC768CE8B8A1&ex=simpli.fi&status=ok
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Sun, 06 Feb 2022 01:01:06 GMT

GET
H2 200 amzns2s Show response
rtb.gumgum.com/usync/ Frame D14C 4 KB
2 KB 88ms
25ms Document
text/html 52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2635a8a75ace8ee79651f10a2aeb07252c37f791fbd4027fd3fcac9541fd91c2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-type: text/html;charset=UTF-8
server: nginx
etag: W/"02d965345682733664f0c34668870b974"
timing-allow-origin: *
content-encoding: gzip

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame 635A
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1

2 KB
3 KB

37ms
36ms

Document
text/html

184.29.129.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.29.129.7 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-129-7.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4c88b5372d0af1c92e19358f6c0ace52531328656bb2922fc3287faa8b102f89

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Apache
Content-Type: text/html
Dropped-Udsids: 39|241|45|230|73|90|188|65
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary: Is-Traffic-Usersync
Expires: Mon, 07 Feb 2022 01:01:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Length: 1616
Connection: keep-alive

Redirect headers

Server: Apache
Content-Length: 335
Content-Type: text/html; charset=iso-8859-1
Location: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires: Mon, 07 Feb 2022 01:01:06 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Connection: keep-alive

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 99E1 729 B
771 B 38ms
30ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 956cc30d20699fb2c6a96eb0b57cb160a9cb2f9d8032b1310a076aa6254ee077

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

vary: Accept, Accept-Encoding
server: OXGW/17.1.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 07 Feb 2022 01:01:06 GMT
content-type: text/html
content-length: 460
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 1B49
Redirect Chain

https://ssbsync-us.smartadserver.com/api/sync?callerId=2&gdpr=0
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=6265046972229500172&gdpr=0&gdpr_consent=

43 B
556 B

39ms
29ms

Document
image/gif

209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=6265046972229500172&gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: 9S64AHBWFZ0G2RS1P7WK
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-length: 0
location: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=6265046972229500172&gdpr=0&gdpr_consent=

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 70C4
Redirect Chain

https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr=0
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=0&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
https://id5-sync.com/c/495/0/0/1.gif?gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOeHO4E2l_im5mwm1XziuByWMZngabgg1G8Ohvnw

43 B
556 B

31ms
31ms

Document
image/gif

209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOeHO4E2l_im5mwm1XziuByWMZngabgg1G8Ohvnw

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Mon, 07 Feb 2022 01:01:07 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: XK2YJ2KSTBS7BR2W8B1D
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

P3P: CP="CAO PSA OUR"
Location: https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-ZHMOeHO4E2l_im5mwm1XziuByWMZngabgg1G8Ohvnw
Transfer-Encoding: chunked
Date: Mon, 07 Feb 2022 01:01:06 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

GET
H2

200

index.html Show response
cdn.districtm.io/ids/ Frame 034D
Redirect Chain

https://cdn.districtm.io/ids/?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D&gdpr=0
https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D&gdpr=0

116 B
341 B

106ms
106ms

Document
text/html

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-type: text/html
cf-ray: 6d98af64ab208c15-EWR
age: 31370
last-modified: Thu, 20 May 2021 02:18:27 GMT
via: 1.1 bc026bbeb6351b9fc6315a678d5987e6.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id: 9s6kXi50sv95V9CdCl4-hMQ5XwtYNI56JuwFcuDa3ZvWyuJtnsM4xA==
x-amz-cf-pop: LAX3-C4
x-cache: Hit from cloudfront
vary: Accept-Encoding
server: cloudflare
content-encoding: br

Redirect headers

date: Mon, 07 Feb 2022 01:01:06 GMT
location: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D&gdpr=0
cf-ray: 6d98af646aa58c15-EWR
cache-control: max-age=3600
expires: Mon, 07 Feb 2022 02:01:06 GMT
vary: Accept-Encoding
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame 023E 427 B
613 B 85ms
25ms Document
text/html 34.233.74.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.74.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-74-164.compute-1.amazonaws.com
Software: /
Resource Hash: 33244e5d9dac21bbca4ea183849f4e2cddd62c3b0772a97c15b63b433007ef8d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-length: 427

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 12B7 15 KB
6 KB 82ms
19ms Document
text/html 184.29.128.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.29.128.213 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-128-213.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

last-modified: Tue, 01 Feb 2022 06:38:00 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5549
content-type: text/html; charset=UTF-8
cache-control: max-age=141394
expires: Tue, 08 Feb 2022 16:17:40 GMT
date: Mon, 07 Feb 2022 01:01:06 GMT
vary: Accept-Encoding

GET
H2 200 tamptsync Show response
sync-amz.ads.yieldmo.com/ Frame 157A 893 B
1 KB 92ms
24ms Document
text/html 34.236.20.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.236.20.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-20-32.compute-1.amazonaws.com
Software: /
Resource Hash: 3db4bdc8b14f95d633c1bf496d0237d9c4185603d40b36c4934cbed06d06cbde

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 1886 281 B
554 B 89ms
20ms Document
text/html 23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 07 Feb 2022 01:01:06 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame B50A
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid=%24UID&ex=appnexus.com&gdpr=0
https://s.amazon-adsystem.com/ecm3?id=402116596189329890&ex=appnexus.com&gdpr=0

43 B
556 B

44ms
29ms

Document
image/gif

209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=402116596189329890&ex=appnexus.com&gdpr=0

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: WAFAQB0E9WV8KMK5KMYX
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

Server: nginx/1.17.9
Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Location: https://s.amazon-adsystem.com/ecm3?id=402116596189329890&ex=appnexus.com&gdpr=0
AN-X-Request-Uuid: 3b32a281-5622-4162-b7b3-b0dd7e6eac6a
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com

GET
H/1.1

200
OK

amazon Show response
ap.lijit.com/beacon/ Frame DE30
Redirect Chain

https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0
https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1

1 KB
1 KB

23ms
23ms

Document
text/html

23.92.190.69
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.69 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: eae4c25b68f088fa469f7cb03bd72426f07bfac26827bc17793b5c7593d2d3aa

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: nginx
Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Vary: Accept-Encoding
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
Content-Encoding: gzip
X-Sovrn-Pod: ad_ap3ewr1

Redirect headers

Server: nginx
Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap3ewr1

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 95A2
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID&gdpr=0
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2610069735325096551171

43 B
556 B

34ms
30ms

Document
image/gif

209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2610069735325096551171

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: VTCTG6AK0NKJPK2P63BW
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-length: 0
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=2610069735325096551171
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 99E1 43 B
556 B 31ms
31ms Image
image/gif 209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=654de6d0-8fa8-8f82-b1ec-d2e95c2eac90&gdpr=0

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: A631X2ZKD1MVF26FFGK0
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 99E1
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YgBvUgAEUHzwywBH
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YgBvUgAEUHzwywBH&_test=YgBvUgAEUHzwywBH

43 B
61 B

44ms
28ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YgBvUgAEUHzwywBH&_test=YgBvUgAEUHzwywBH
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1644195667.713967,VS0,VE0
x-served-by: cache-yul12820-YUL
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YgBvUgAEUHzwywBH&_test=YgBvUgAEUHzwywBH
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 a95cfce9-03ae-a631-4035-468bcb4aaa39
pr-bh.ybp.yahoo.com/sync/openx/ Frame 99E1 43 B
987 B 92ms
27ms Image
image/gif 2600:1f18:4e9:5a01:8195:c898:f037:e181
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/a95cfce9-03ae-a631-4035-468bcb4aaa39?gdpr=0

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:8195:c898:f037:e181 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 99E1
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=3d9b9aad-9302-3478-71e2-507e341d6770&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=3d9b9aad-9302-3478-71e2-507e341d6770&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=de71345a-edfe-429a-9e27-b13a5e9ebea0&ttd_puid=3d9b9aad-9302-3478-71e2-507e341d6770

43 B
62 B

37ms
29ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=de71345a-edfe-429a-9e27-b13a5e9ebea0&ttd_puid=3d9b9aad-9302-3478-71e2-507e341d6770
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=de71345a-edfe-429a-9e27-b13a5e9ebea0&ttd_puid=3d9b9aad-9302-3478-71e2-507e341d6770
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 293

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 99E1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTFmNDQ5NjctNWE3NS02YWRjLTY0MDItMGFjN2ZlZmZhOTEw
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTFmNDQ5NjctNWE3NS02YWRjLTY0MDItMGFjN2ZlZmZhOTEw&google_tc=

170 B
188 B

75ms
44ms

Image
image/png

172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTFmNDQ5NjctNWE3NS02YWRjLTY0MDItMGFjN2ZlZmZhOTEw&google_tc=

Requested by

Protocol

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTFmNDQ5NjctNWE3NS02YWRjLTY0MDItMGFjN2ZlZmZhOTEw&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 99E1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHPkJm1TavmgL28-Ue07afk&google_cver=1

43 B
61 B

30ms
29ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHPkJm1TavmgL28-Ue07afk&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D&gdpr=0
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEHPkJm1TavmgL28-Ue07afk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 87ms
38ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 07 Feb 2022 01:01:06 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
https://rtb.gumgum.com/usersync?b=apn&i=402116596189329890

35 B
208 B

34ms
30ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=apn&i=402116596189329890
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 634.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 95721e18-a64c-40ab-8b0d-e14f4a6a0155
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://rtb.gumgum.com/usersync?b=apn&i=402116596189329890
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_a7c4269f-d61c-4107-a186-69e506753a7b&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_a7c4269f-d61c-4107-a186-69e506753a7b&gdpr=0&gdpr_consent=&us_privacy=
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgumgum2
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgumgum2
https://x.bidswitch.net/sync?dsp_id=59&user_id=02fc5ae8-6530-46b1-ae91-c7bb6de8b48a&ssp=gumgum2
https://rtb.gumgum.com/usersync?b=bsw&i=71752e87-3832-4eac-809a-985a64d26fbc

35 B
208 B

33ms
32ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=bsw&i=71752e87-3832-4eac-809a-985a64d26fbc
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: //rtb.gumgum.com/usersync?b=bsw&i=71752e87-3832-4eac-809a-985a64d26fbc
Date: Mon, 07 Feb 2022 01:01:07 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame D14C
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
https://rtb.gumgum.com/usersync?b=obn&i=ENC%28t9TsB3H_7qsk5Y6AJcQr_0_d5ALN7K1Lt9nS0fTbFbjVTUzFWH2X8dyGGHsEQa1S%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_a7c4269f-d61c-4107-a186-69e506753a7b&obuid=ENC(t9TsB3H_7qsk5Y6AJcQr_0_d5ALN7K1Lt9nS0fTbFbjVTUzFWH2X8dyGGHsEQa1S)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=15268
https://sync.outbrain.com/cookie-sync?p=rubicon&uid=KZBZNC43-2-ITLV

0
286 B

22ms
22ms

Image
text/plain

64.202.112.223
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=KZBZNC43-2-ITLV
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Server: 64.202.112.223 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 07 Feb 2022 01:01:07 GMT
Cache-Control: no-cache
X-TraceId: 25800e0ab6e340ed3a52e721fb95aace
Content-Length: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://sync.outbrain.com/cookie-sync?p=rubicon&uid=KZBZNC43-2-ITLV
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 29af2665c43893332e84c235bac366c1
Expires: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://rtb.gumgum.com/usersync?b=opx&i=caa63edd-bb17-0c2e-1699-4093fc4d6636

35 B
208 B

31ms
31ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=opx&i=caa63edd-bb17-0c2e-1699-4093fc4d6636
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-encoding: gzip
server: OXGW/17.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://rtb.gumgum.com/usersync?b=opx&i=caa63edd-bb17-0c2e-1699-4093fc4d6636
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=sta&i=0-6af94e52-d649-4295-569b-a02b54df408d$ip$149.56.153.181

35 B
208 B

33ms
32ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=sta&i=0-6af94e52-d649-4295-569b-a02b54df408d$ip$149.56.153.181
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=sta&i=0-6af94e52-d649-4295-569b-a02b54df408d$ip$149.56.153.181
Date: Mon, 07 Feb 2022 01:01:06 GMT
Connection: keep-alive
Content-Length: 123
Content-Type: text/html; charset=utf-8

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=oth&i=y-mwgaJQNE2peeJR.bcQTipoeuW3xJhVJQ0eBH~A

35 B
208 B

34ms
33ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=oth&i=y-mwgaJQNE2peeJR.bcQTipoeuW3xJhVJQ0eBH~A
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Mon, 07 Feb 2022 01:01:06 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://rtb.gumgum.com/usersync?b=oth&i=y-mwgaJQNE2peeJR.bcQTipoeuW3xJhVJQ0eBH~A
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%...
https://rtb.gumgum.com/usersync?b=vnt&i=6e1e8e34-87b1-11ec-a9bf-a10e15a78249

35 B
208 B

33ms
32ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=vnt&i=6e1e8e34-87b1-11ec-a9bf-a10e15a78249
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=vnt&i=6e1e8e34-87b1-11ec-a9bf-a10e15a78249
Date: Mon, 07 Feb 2022 01:01:06 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 6e1e8e35-87b1-11ec-a9bf-a10e15a78249

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://rtb.gumgum.com/usersync?b=snc&i=F941146CDB0C425A957A99437B9BDF02

35 B
208 B

32ms
32ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=snc&i=F941146CDB0C425A957A99437B9BDF02
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Mon, 07 Feb 2022 01:01:06 GMT
via: 1.1 varnish
server: nginx
age: 0
location: https://rtb.gumgum.com/usersync?b=snc&i=F941146CDB0C425A957A99437B9BDF02
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: text/plain
access-control-allow-origin: https://rtb.gumgum.com/
access-control-allow-credentials: true
x-varnish: 985728588
content-length: 0

GET
H2 200 142
match.deepintent.com/usersync/ Frame D14C 0
221 B 80ms
25ms Image
image/gif 169.197.150.8
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
server: a
content-type: image/gif
content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_a7c4269f-d61c-4107-a186-69e506753a7b&gdpr=0&gdpr_consent=&us_privacy=
https://stags.bluekai.com/site/23178?id=aj9NLrm3qPua4QBfxJuE&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2YLKHFHEY4TNGNYVA5LBGRIUEZTYJJ2UK
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=aj9NLrm3qPua4QBfxJuE

35 B
208 B

31ms
31ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=aj9NLrm3qPua4QBfxJuE
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
P3p: CP="We do not support P3P header."
Location: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=aj9NLrm3qPua4QBfxJuE
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 98
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://rtb.gumgum.com/usersync?b=idi&i=047ad20d-3ecb-4909-bd9a-dce86fe66783

35 B
208 B

33ms
32ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=idi&i=047ad20d-3ecb-4909-bd9a-dce86fe66783
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

location: https://rtb.gumgum.com/usersync?b=idi&i=047ad20d-3ecb-4909-bd9a-dce86fe66783
date: Mon, 07 Feb 2022 01:01:06 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/floor6?zcc=1&cb=1644195666909
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6395897304
https://sync.1rx.io/usersync/tradedesk/de71345a-edfe-429a-9e27-b13a5e9ebea0
https://sync.targeting.unrulymedia.com/csync/RX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005
https://rtb.gumgum.com/usersync?b=rhy&i=RX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005

35 B
208 B

43ms
42ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=rhy&i=RX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Date: Mon, 07 Feb 2022 01:01:07 GMT
Server: Tengine
ETag: RX68074e063a3045bfb31eb48d56fdbb5b005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://rtb.gumgum.com/usersync?b=rhy&i=RX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005
Connection: keep-alive
Content-Type: text/html

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=KYxsYg8f1MpS&ev=1&pid=558355

35 B
208 B

32ms
31ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=KYxsYg8f1MpS&ev=1&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-CA
location: https://rtb.gumgum.com/usersync?b=pln&i=KYxsYg8f1MpS&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-56659f45bd-prh8b
expires: -1

GET
H2

200

usersync
rtb.gumgum.com/ Frame D14C
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15
https://rtb.gumgum.com/usersync?b=sad&i=6265046972229500172&gdpr=0&gdpr_consent=

35 B
208 B

32ms
31ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=sad&i=6265046972229500172&gdpr=0&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

location: https://rtb.gumgum.com/usersync?b=sad&i=6265046972229500172&gdpr=0&gdpr_consent=
date: Mon, 07 Feb 2022 01:01:06 GMT
content-length: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame D14C 43 B
556 B 33ms
32ms Image
image/gif 209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=u_a7c4269f-d61c-4107-a186-69e506753a7b

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: XZ3DA83WGM8N8WEV6VDT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 023E 43 B
556 B 31ms
30ms Image
image/gif 209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=d2a53381-6c3c-4e63-b1ca-ad33cc55769d

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: HAJ8Z3Z8EGB9MHSYSE7D
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 023E
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=

68 B
262 B

27ms
23ms

Image
image/png

34.233.74.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 34.233.74.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-74-164.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 023E
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=

68 B
262 B

24ms
24ms

Image
image/png

34.233.74.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 34.233.74.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-74-164.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 323

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 023E
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
https://ssum.casalemedia.com/usermatchredir?s=186046&cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DGM7HYz3VFjuymbiqnJLyjuPy%26source_user_id%3D__UID__
https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=YgBvUjbsKtG9r1wKyiASNgAA%26023

68 B
262 B

23ms
23ms

Image
image/png

34.233.74.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=YgBvUjbsKtG9r1wKyiASNgAA%26023
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 34.233.74.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-74-164.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=YgBvUjbsKtG9r1wKyiASNgAA%26023
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 307
Expires: Mon, 07 Feb 2022 01:01:06 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 023E
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=

68 B
262 B

23ms
23ms

Image
image/png

34.233.74.164
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 34.233.74.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-74-164.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 323

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 9EA2
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://rtb.gumgum.com/usersync?b=mmh&i=30bf6200-6f52-4100-a005-c1ed9289aa7e&gdpr=0&gdpr_consent=

35 B
208 B

31ms
30ms

Document
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=mmh&i=30bf6200-6f52-4100-a005-c1ed9289aa7e&gdpr=0&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Access-Control-Allow-Origin: *
Server: MT3 4133 baa842e master iad-pixel-x18 config:1.0.0
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://rtb.gumgum.com/usersync?b=mmh&i=30bf6200-6f52-4100-a005-c1ed9289aa7e&gdpr=0&gdpr_consent=
Expires: Mon, 07 Feb 2022 01:01:05 GMT

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 3FF7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=atm&i=YgBvUgAEUHzwywBH&gdpr=0&gdpr_consent=

35 B
208 B

31ms
28ms

Document
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=atm&i=YgBvUgAEUHzwywBH&gdpr=0&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

server: Varnish
retry-after: 0
location: https://rtb.gumgum.com/usersync?b=atm&i=YgBvUgAEUHzwywBH&gdpr=0&gdpr_consent=
accept-ranges: bytes
date: Mon, 07 Feb 2022 01:01:06 GMT
via: 1.1 varnish
x-served-by: cache-yul12820-YUL
x-cache: HIT
x-cache-hits: 0
x-timer: S1644195667.709061,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H3

200

pixel Show response
cm.g.doubleclick.net/ Frame 758F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9hN2M0MjY5Zi1kNjFjLTQxMDctYTE4Ni02OWU1MDY3NTNhN2I=&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9hN2M0MjY5Zi1kNjFjLTQxMDctYTE4Ni02OWU1MDY3NTNhN2I=&gdpr=0&gdpr_consent=&google_tc=

170 B
188 B

57ms
43ms

Document
image/png

172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9hN2M0MjY5Zi1kNjFjLTQxMDctYTE4Ni02OWU1MDY3NTNhN2I=&gdpr=0&gdpr_consent=&google_tc=

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

content-type: image/png
date: Mon, 07 Feb 2022 01:01:06 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
server: HTTP server (unknown)
content-length: 170
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9hN2M0MjY5Zi1kNjFjLTQxMDctYTE4Ni02OWU1MDY3NTNhN2I=&gdpr=0&gdpr_consent=&google_tc=
date: Mon, 07 Feb 2022 01:01:06 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 364
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame DF8D 15 KB
6 KB 20ms
18ms Document
text/html 184.29.128.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.29.128.213 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-128-213.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

last-modified: Tue, 01 Feb 2022 06:38:00 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5549
content-type: text/html; charset=UTF-8
cache-control: max-age=141394
expires: Tue, 08 Feb 2022 16:17:40 GMT
date: Mon, 07 Feb 2022 01:01:06 GMT
vary: Accept-Encoding

GET
H2

200

/ Show response
hde.tynt.com/deb/ Frame 26DB
Redirect Chain

https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
https://de.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1

1 KB
2 KB

45ms
35ms

Document
text/html

67.202.105.31
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.31 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip31.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: 3749130378d45a465fb1fbeb72baa4cb54759cbfe89c4266160b90f105acc8f8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires: Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy: unsafe-url
content-type: text/html
content-length: 1521
date: Mon, 07 Feb 2022 01:01:05 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Redirect headers

location: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires: Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy: unsafe-url
content-length: 0
date: Mon, 07 Feb 2022 01:01:06 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 1CE7
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=ttd&i=de71345a-edfe-429a-9e27-b13a5e9ebea0&t=1646787666

35 B
208 B

31ms
31ms

Document
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=ttd&i=de71345a-edfe-429a-9e27-b13a5e9ebea0&t=1646787666
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-type: text/html
content-length: 209
location: https://rtb.gumgum.com/usersync?b=ttd&i=de71345a-edfe-429a-9e27-b13a5e9ebea0&t=1646787666
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame E77F
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

23ms
23ms

Document
text/html

23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 07 Feb 2022 01:01:06 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

server: AkamaiGHost
content-length: 0
location: https://eus.rubiconproject.com/usync.html?p=gumgum
date: Mon, 07 Feb 2022 01:01:06 GMT
access-control-allow-credentials: true
access-control-allow-origin: *

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame E878
Redirect Chain

https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID&b64_redirect=aHR0cHM6Ly9ydGIuZ3VtZ3VtLmNvbS91c2Vyc3l...
https://cs.emxdgt.com/umcheck?apnxid=402116596189329890&redirect=https://rtb.gumgum.com/usersync?b=emx&i=$EMXUID&b64_redirect=aHR0cHM6Ly9ydGIuZ3VtZ3VtLmNvbS91c2Vyc3luYz9iPWVteCZpPSRFTVhVSUQ=
https://rtb.gumgum.com/usersync?b=emx&i=402116596189329890brt57451644195666818539a2

35 B
208 B

33ms
32ms

Document
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=emx&i=402116596189329890brt57451644195666818539a2
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

content-type: text/html
date: Mon, 07 Feb 2022 01:01:06 GMT
location: https://rtb.gumgum.com/usersync?b=emx&i=402116596189329890brt57451644195666818539a2
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame EC96
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://rtb.gumgum.com/usersync?b=sus&i=YgBvU8Co8XUAAO811dcAAAAA

35 B
208 B

38ms
36ms

Document
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=sus&i=YgBvU8Co8XUAAO811dcAAAAA
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Server: nginx
Date: Mon, 07 Feb 2022 01:01:07 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private
Location: https://rtb.gumgum.com/usersync?b=sus&i=YgBvU8Co8XUAAO811dcAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-Ads-Time: 3
X-SO-HostName: m-ad199.dc4p.scaleout.jp
X-SO-LB-Hostname: m-tgng17.dc4p.scaleout.jp
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":58,"gdpr":false,"ipv4":"149.56.153.181","key":"YgBvU8Co8XUAAO811dcAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad199"}
X-SO-Key: YgBvU8Co8XUAAO811dcAAAAA
X-SO-IP: 149.56.153.181
X-SO-Cluster-ID: 58
X-SO-Upstream-ID: m-ad199

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame B77C
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://rtb.gumgum.com/usersync?b=rth&i=a7DYWApkJarPJWIbfihw&pi=gumgum&tc=1

35 B
208 B

32ms
32ms

Document
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=rth&i=a7DYWApkJarPJWIbfihw&pi=gumgum&tc=1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://rtb.gumgum.com/

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Mon, 07 Feb 2022 01:01:07 GMT Mon, 07 Feb 2022 01:01:07 GMT
location: https://rtb.gumgum.com/usersync?b=rth&i=a7DYWApkJarPJWIbfihw&pi=gumgum&tc=1
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 1886 32 KB
10 KB 18ms
18ms Script
text/html 23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 9063e9df2b2c8b49b8f7314f9dfb196e53c9f92c342a5419604801f7774a1d24

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Dec 2021 23:04:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=75732
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9702
Expires: Mon, 07 Feb 2022 22:03:18 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 157A 43 B
556 B 29ms
29ms Image
image/gif 209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=g1aa1a85ca6f83d47d43&gdpr=0

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 9JGAKRJ9C84VRRRQWX8R
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

404
Not Found

sync
ib.adnxs.com/&https://ads.yieldmo.com/v000/ Frame 157A
Redirect Chain

https://ib.adnxs.com/getuid?&https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an
https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=402116596189329890&pn_id=an

0
585 B

68ms
68ms

Image
text/html

68.67.179.113
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=402116596189329890&pn_id=an

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0

Protocol

HTTP/1.1

Server

68.67.179.113 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a23-198-216-24.deploy.static.akamaitechnologies.com

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: f6ec4e2b-910a-423e-be16-8fe94360e9fe
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 7ab93b8f-9e09-4045-8d83-d5ebc3d7941f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: &https://ads.yieldmo.com/v000/sync?userid=402116596189329890&pn_id=an
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.yieldmo.com/ Frame 157A
Redirect Chain

https://x.bidswitch.net/sync?&ssp=yieldmo
https://x.bidswitch.net/ul_cb/sync?&ssp=yieldmo
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=yieldmo
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=yieldmo
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=e8e0816b-2dbe-4774-9ede-25a0a0db6db1&ssp=yieldmo
https://ads.yieldmo.com/sync?userid=71752e87-3832-4eac-809a-985a64d26fbc&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=

43 B
639 B

27ms
27ms

Image
image/gif

54.157.214.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/sync?userid=71752e87-3832-4eac-809a-985a64d26fbc&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 54.157.214.210 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-157-214-210.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
content-type: image/gif
content-length: 43
access-control-allow-methods: GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

Redirect headers

Location: //ads.yieldmo.com/sync?userid=71752e87-3832-4eac-809a-985a64d26fbc&pn_id=bsw&extinit=0&gdpr=&gdpr_consent=
Date: Mon, 07 Feb 2022 01:01:07 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame 157A
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?&ttd_pid=yieldmo
https://ads.yieldmo.com/v000/sync?tdid=de71345a-edfe-429a-9e27-b13a5e9ebea0

43 B
328 B

115ms
26ms

Image
image/gif

54.157.214.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?tdid=de71345a-edfe-429a-9e27-b13a5e9ebea0
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 54.157.214.210 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-157-214-210.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
content-type: image/gif
content-length: 43
access-control-allow-methods: GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ads.yieldmo.com/v000/sync?tdid=de71345a-edfe-429a-9e27-b13a5e9ebea0
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 181

GET
H2

200

sync
ads.yieldmo.com/ Frame 157A
Redirect Chain

https://sync.srv.stackadapt.com/sync?&nid=21
https://ads.yieldmo.com/sync?pn_id=stk&userid=iaXU0zWeTANB7OlDhqwleZU4mbU

43 B
326 B

36ms
27ms

Image
image/gif

54.157.214.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/sync?pn_id=stk&userid=iaXU0zWeTANB7OlDhqwleZU4mbU
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 54.157.214.210 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-157-214-210.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
content-type: image/gif
content-length: 43
access-control-allow-methods: GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

Redirect headers

Location: https://ads.yieldmo.com/sync?pn_id=stk&userid=iaXU0zWeTANB7OlDhqwleZU4mbU
Date: Mon, 07 Feb 2022 01:01:06 GMT
Connection: keep-alive
Content-Length: 100
Content-Type: text/html; charset=utf-8

GET
H2

200

sync
sync-pp.ads.yieldmo.com/ Frame 157A
Redirect Chain

https://bh.contextweb.com/bh/rtset?&pid=561118&ev=1&rurl=https://sync-pp.ads.yieldmo.com/sync?userid=%%VGUID%%&pn_id=pp
https://sync-pp.ads.yieldmo.com/sync?userid=HPxKEVXFcu56&ev=1&pn_id=pp&pid=561118

43 B
313 B

61ms
24ms

Image
image/gif

34.236.20.32
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-pp.ads.yieldmo.com/sync?userid=HPxKEVXFcu56&ev=1&pn_id=pp&pid=561118
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol: H2
Server: 34.236.20.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-236-20-32.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync-amz.ads.yieldmo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
content-type: image/gif
content-length: 43
access-control-allow-methods: GET, OPTIONS
access-control-request-headers: Cache-Control, Pragma

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-CA
location: https://sync-pp.ads.yieldmo.com/sync?userid=HPxKEVXFcu56&ev=1&pn_id=pp&pid=561118
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-56659f45bd-2l9r9
expires: -1

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame DE30 43 B
556 B 30ms
30ms Image
image/gif 209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=c1243ebe78df80deee655c12&ex=sovrn.com&gdpr=0&gdpr=0&gdpr_consent=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 2NFN3EF28HATC2FZX5G5
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame DE30
Redirect Chain

https://pixel.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=HbDlYh3k4GAG4eE2Grr4ahyxsDMGtrAzH-P6eTW8

43 B
862 B

59ms
19ms

Image
image/gif

23.92.190.69
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=HbDlYh3k4GAG4eE2Grr4ahyxsDMGtrAzH-P6eTW8
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.69 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=HbDlYh3k4GAG4eE2Grr4ahyxsDMGtrAzH-P6eTW8
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 cksync.php
contextual.media.net/ Frame DE30 45 B
617 B 172ms
102ms Image
image/gif 23.198.216.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=sov&ovsid=c1243ebe78df80deee655c12&redirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D1023%263pid%3D%24%7BUSER%7D&gdpr=0&gdpr_consent=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.198.216.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Mon, 07 Feb 2022 01:01:06 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 45
x-mnet-hl2: E
expires: Mon, 07 Feb 2022 01:01:06 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame DE30
Redirect Chain

https://um.simpli.fi/lj_match?r=1644195666626&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=2&3pid=9A300A08850D4F8E9BE6AC768CE8B8A1

43 B
853 B

67ms
21ms

Image
image/gif

23.92.190.69
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=9A300A08850D4F8E9BE6AC768CE8B8A1
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.69 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Mon, 07 Feb 2022 01:01:06 GMT
x-content-type-options: nosniff
server: nginx
location: https://ce.lijit.com/merge?pid=2&3pid=9A300A08850D4F8E9BE6AC768CE8B8A1
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Sun, 06 Feb 2022 01:01:06 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame DE30
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=185&cm=c1243ebe78df80deee655c12&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=84&3pid=c:5a4b023959421b5a5a2e9b1c479f109d

43 B
856 B

24ms
22ms

Image
image/gif

23.92.190.69
INTERNAP-BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=84&3pid=c:5a4b023959421b5a5a2e9b1c479f109d
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol: HTTP/1.1
Server: 23.92.190.69 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Mon, 7 Feb 2022 01:01:06 GMT
server: Aorta/20220128.132aca1
access-control-allow-origin
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
Location: https://ce.lijit.com/merge?pid=84&3pid=c:5a4b023959421b5a5a2e9b1c479f109d
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
X-Aorta-Region: us-east-1
Connection: keep-alive
X-Aorta-Host: ip-10-42-16-68.ec2.internal
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
Content-Length: 0

GET
H/1.1

200
OK

epx.gif
px.owneriq.net/fr/ Frame DE30
Redirect Chain

https://px.owneriq.net/eucm/p/sv?gdpr=0&gdpr_consent=
https://px.owneriq.net/ecc?redir=https%3a%2f%2fpx.owneriq.net%2ffr%2fepx.gif&uid=Q6974820661065218524&ref=%2Feucm%2Fp%2Fsv
https://px.owneriq.net/fr/epx.gif

43 B
402 B

57ms
19ms

Image
image/gif

23.4.227.170
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.owneriq.net/fr/epx.gif
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol: HTTP/1.1
Server: 23.4.227.170 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-4-227-170.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 07 Feb 2022 01:01:07 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: max-age=249256
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 09 Feb 2022 22:15:23 GMT

Redirect headers

Date: Mon, 07 Feb 2022 01:01:06 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://px.owneriq.net/fr/epx.gif
Cache-Control: max-age=84272
Connection: keep-alive
Content-Type: text/html
Content-Length: 154

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 335ms
24ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1537
date: Mon, 07 Feb 2022 01:01:06 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 12B7 2 KB
2 KB 88ms
19ms Script
text/html 104.36.115.113
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=10796817&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.113 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 558c647243d8a784f9074fa09d1600650c752a28ed8e2c4fcb2d5e3efd7f31eb

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 1569
content-type: text/html; charset=UTF-8

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 635A
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&expiration=1646787666&gdpr=0&gdpr_consent=

43 B
1006 B

65ms
26ms

Image
image/gif

184.29.129.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&expiration=1646787666&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: HTTP/1.1
Server: 184.29.129.7 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-129-7.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 07 Feb 2022 01:01:06 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0&expiration=1646787666&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 323

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 635A 43 B
932 B 35ms
30ms Image
image/gif 209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=YgBvUjbsKtG9r1wKyiASNgAAABcAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: JFNV8VQWT32MFQT2ZYNN
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 635A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YgBvUjbsKtG9r1wKyiASNgAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1

43 B
1 KB

26ms
26ms

Image
image/gif

184.29.129.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: HTTP/1.1
Server: 184.29.129.7 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-129-7.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 07 Feb 2022 01:01:06 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame 635A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YgBvUjbsKtG9r1wKyiASNgAAABcAAAAB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEE1l0S-_CQyw89FMT7Eupms&google_cver=1

43 B
315 B

31ms
31ms

Image
image/gif

184.29.129.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEE1l0S-_CQyw89FMT7Eupms&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: HTTP/1.1
Server: 184.29.129.7 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-129-7.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Server: Apache
Vary: Is-Traffic-Usersync
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 43
Expires: Mon, 07 Feb 2022 01:01:06 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEE1l0S-_CQyw89FMT7Eupms&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 YgBvUjbsKtG9r1wKyiASNgAAABcAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 635A 43 B
986 B 36ms
31ms Image
image/gif 2600:1f18:4e9:5a01:8195:c898:f037:e181
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YgBvUjbsKtG9r1wKyiASNgAAABcAAAAB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:8195:c898:f037:e181 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 635A
Redirect Chain

https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=9A300A08850D4F8E9BE6AC768CE8B8A1

43 B
1002 B

68ms
29ms

Image
image/gif

184.29.129.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=9A300A08850D4F8E9BE6AC768CE8B8A1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: HTTP/1.1
Server: 184.29.129.7 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-129-7.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 07 Feb 2022 01:01:06 GMT

Redirect headers

date: Mon, 07 Feb 2022 01:01:06 GMT
x-content-type-options: nosniff
server: nginx
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=9A300A08850D4F8E9BE6AC768CE8B8A1
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Sun, 06 Feb 2022 01:01:06 GMT

GET
H/1.1 200
OK CookieIndex
rtb.adentifi.com/ Frame 635A 0
88 B 136ms
22ms Image
text/plain 18.211.103.66
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.211.103.66 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-211-103-66.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET
H/1.1

200
OK

rum
dsum.casalemedia.com/ Frame 635A
Redirect Chain

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
https://casale-match.dotomi.com/match/bounce/current?DotomiTest=7f787ea12d981215&is_secure=true&networkId=19998&version=1
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGbaO_ZqcH7AMevPQjAAAAAAA&expiration=1644282066&is_secure=true

43 B
1 KB

93ms
26ms

Image
image/gif

184.29.129.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGbaO_ZqcH7AMevPQjAAAAAAA&expiration=1644282066&is_secure=true
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol: HTTP/1.1
Server: 184.29.129.7 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-129-7.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 07 Feb 2022 01:01:07 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGbaO_ZqcH7AMevPQjAAAAAAA&expiration=1644282066&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 635A 43 B
556 B 33ms
30ms Image
image/gif 209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=index.com&id=YgBvUjbsKtG9r1wKyiASNgAAABcAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:06 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: A8T1NEVDBPRBX7VC0591
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 00BF 13 KB
5 KB 55ms
20ms Document
text/html 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 06 Feb 2022 19:31:37 GMT
expires: Mon, 06 Feb 2023 19:31:37 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 19769
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 5F91 783 B
1 KB 87ms
39ms Document
text/html 2607:f8b0:4006:816::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

506b1546feeb03cda57118a18462d5d0e577199bde1c6a35b78efb1b5ace3636

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-y1pEpy3Nc09+lglHhtKAsQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 07 Feb 2022 01:01:06 GMT
date: Mon, 07 Feb 2022 01:01:06 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-y1pEpy3Nc09+lglHhtKAsQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 511
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://id5-sync.com/i/341/8.gif?id5id=ID5*aqPEuVjDC4y2SX1XQF3eImw92GuwJEyVDNDBwMi0dvYHLKgF0XgpKS9Iah_qg9E2By2QkyMmTt0dSwH5qkx4ywcu1AIufkBClE_Wkh5w6GgHLwA6B9dT8HG4o7pSQ7ZlBzCOToktgJB-xxx-Ah24Zwcx2d...
https://ib.adnxs.com/getuid?https://id5-sync.com/c/341/2/7/2.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/341/2/7/2.gif?puid=402116596189329890&gdpr=0&gdpr_consent=
https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-ZHMOeHO4E2l_im5mwm1XziuByWMZngabgg1G8Ohvnw&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F3%2F6%2F3.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26g...
https://id5-sync.com/c/341/3/6/3.gif?puid=30bf6200-6f52-4100-a005-c1ed9289aa7e&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=de71345a-edfe-429a-9e27-b13a5e9ebea0&ttl=%%TTL%%
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F429%2F4%2F5.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/341/429/4/5.gif?puid=235A5332-1129-4F0C-B691-00DE56507837&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F434%2F3%2F6.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/341/434/3/6.gif?puid=952fd169-ed03-491c-b5a2-af70efd0d80c&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F108%2F2%2F7.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F108%2F2%2F7.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gd...
https://id5-sync.com/c/341/108/2/7.gif?puid=c766176e-12cb-44dd-85d3-74dfcdc3f874&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fid5-sync.com%2Fc%2F341%2F136%2F1%2F8.gif%3Fpuid%3D%24%7BTM_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/341/136/1/8.gif?puid=YgBvUgAEUHzwywBH&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us.gif?nw=i5mm&nuid=30bf6200-6f52-4100-a005-c1ed9289aa7e&gdpr=0&consent=&id5id=ID5-ZHMOeHO4E2l_im5mwm1XziuByWMZngabgg1G8Ohvnw

49 B
868 B

31ms
31ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=i5mm&nuid=30bf6200-6f52-4100-a005-c1ed9289aa7e&gdpr=0&consent=&id5id=ID5-ZHMOeHO4E2l_im5mwm1XziuByWMZngabgg1G8Ohvnw

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:08 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-57
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: image/gif
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://sync.go.sonobi.com/us.gif?nw=i5mm&nuid=30bf6200-6f52-4100-a005-c1ed9289aa7e&gdpr=0&consent=&id5id=ID5-ZHMOeHO4E2l_im5mwm1XziuByWMZngabgg1G8Ohvnw
Date: Mon, 07 Feb 2022 01:01:07 GMT
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
P3P: CP="CAO PSA OUR"

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 1886 284 B
963 B 114ms
24ms Image
image/jpg 8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?gdpr=0&us_privacy=1---
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 368ba1c92c09ff88b641150fbbf94341
Content-Type: image/jpg

GET
H2 200 idsync.d5cb6b96.js Show response
cdn.districtm.io/ids/ Frame 034D 3 KB
2 KB 39ms
39ms Script
application/javascript 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by: Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D&gdpr=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
via: 1.1 fb134201578e9706e0dd8abdab0f2abf.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 150327
cf-polished: origSize=3302
x-cache: Miss from cloudfront
cf-bgj: minify
content-encoding: br
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: cloudflare
etag: W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=172800
x-amz-cf-pop: JFK51-C1
cf-ray: 6d98af661e288c15-EWR
x-amz-cf-id: eAFQyvDpP0PzfMELvLEVR-hml06ux82vdQ9KWW3mKynTylzMM2bdbw==
expires: Wed, 09 Feb 2022 01:01:06 GMT

GET
H3 200 container.html Show response
49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E545 6 KB
3 KB 49ms
22ms Document
text/html 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 07 Feb 2022 01:01:06 GMT
expires: Tue, 07 Feb 2023 01:01:06 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame E77F 32 KB
10 KB 26ms
25ms Script
text/html 23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 9063e9df2b2c8b49b8f7314f9dfb196e53c9f92c342a5419604801f7774a1d24

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Dec 2021 23:04:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=75732
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9702
Expires: Mon, 07 Feb 2022 22:03:18 GMT

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 195A
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=235A5332-1129-4F0C-B691-00DE56507837
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=235A5332-1129-4F0C-B691-00DE56507837

35 B
467 B

17ms
17ms

Document
image/gif

185.167.164.39
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=235A5332-1129-4F0C-B691-00DE56507837

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID&gdpr=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.39 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 07 Feb 2022 01:01:07 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

server: nginx
date: Mon, 07 Feb 2022 01:01:07 GMT
content-length: 0
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=235A5332-1129-4F0C-B691-00DE56507837
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F0C4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgBvUgAEUHzwywBH&gdpr=0&gdpr_consent=

1 B
549 B

81ms
19ms

Document
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgBvUgAEUHzwywBH&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 07 Feb 2022 01:01:07 GMT
content-type: text/html; charset=utf-8
content-length: 1
x-lat: njrpug020:0:523
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

server: Varnish
retry-after: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgBvUgAEUHzwywBH&gdpr=0&gdpr_consent=
accept-ranges: bytes
date: Mon, 07 Feb 2022 01:01:06 GMT
via: 1.1 varnish
x-served-by: cache-yul12820-YUL
x-cache: HIT
x-cache-hits: 0
x-timer: S1644195667.998909,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame 328C 43 B
556 B 33ms
29ms Document
image/gif 209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=235A5332-1129-4F0C-B691-00DE56507837&ex=pubmatic.com

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

Server: Server
Date: Mon, 07 Feb 2022 01:01:06 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: JEPPHTZBD84NRNK3SNE2
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 12B7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=I1pTMhEpTwy2kQDeVlB4Nw%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

15 KB
15 KB

19ms
19ms

Image
text/html

184.29.128.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Server: 184.29.128.213 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-128-213.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=141393
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5549
expires: Tue, 08 Feb 2022 16:17:40 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

458249.gif
idsync.rlcdn.com/ Frame 12B7
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=235A5332-1129-4F0C-B691-00DE56507837
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJDIzNUE1MzMyLTExMjktNEYwQy1CNjkxLTAwREU1NjUwNzgzNxAAGg0I096BkAYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=6f49463c52626b8dbb33f98d0d6622f01734e53e2db612670ef23da4e39e90ae791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA2ZjQ5NDYzYzUyNjI2YjhkYmIzM2Y5OGQwZDY2MjJmMDE3MzRlNTNlMmRiNjEyNjcwZWYyM2RhNGUzOWU5MGFlNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA2ZjQ5NDYzYzUyNjI2YjhkYmIzM2Y5OGQwZDY2MjJmMDE3MzRlNTNlMmRiNjEyNjcwZWYyM2RhNGUzOWU5MGFlNzkxNDI2YjU0MTdkY2UyMRAAGgwI096BkAYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=516a1e99-aebe-4cc2-96bb-116ad199c4db

42 B
60 B

43ms
42ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=516a1e99-aebe-4cc2-96bb-116ad199c4db
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Feb 2022 01:01:07 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=516a1e99-aebe-4cc2-96bb-116ad199c4db
date: Mon, 07 Feb 2022 01:01:07 GMT
via: 1.1 google
x-samesite: secure
alt-svc: clear
content-length: 111
content-type: text/html; charset=utf-8

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 12B7
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=30bf6200-6f52-4100-a005-c1ed9289aa7e

0
260 B

85ms
20ms

Image
text/plain

104.36.115.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=30bf6200-6f52-4100-a005-c1ed9289aa7e
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Server: 104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:06 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Mon, 07 Feb 2022 01:01:06 GMT
Server: MT3 4133 baa842e master iad-pixel-x16 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=30bf6200-6f52-4100-a005-c1ed9289aa7e
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 07 Feb 2022 01:01:05 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 12B7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MjM1QTUzMzItMTEyOS00RjBDLUI2OTEtMDBERTU2NTA3ODM3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
186 B

84ms
23ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
cache-control: no-store, no-cache, private
x-lat: va1pug013:0:713
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 12B7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBolY2sOIlstY8Fiaosuq0E&google_cver=1

42 B
587 B

83ms
23ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBolY2sOIlstY8Fiaosuq0E&google_cver=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 06 Feb 2022 19:46:11 GMT
cache-control: no-store, no-cache, private
x-lat: va2pug006:0:379
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBolY2sOIlstY8Fiaosuq0E&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 12B7
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:9A300A08850D4F8E9BE6AC768CE8B8A1

42 B
298 B

83ms
24ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:9A300A08850D4F8E9BE6AC768CE8B8A1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
cache-control: no-store, no-cache, private
x-lat: 10:0:778
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Mon, 07 Feb 2022 01:01:07 GMT
x-content-type-options: nosniff
server: nginx
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:9A300A08850D4F8E9BE6AC768CE8B8A1
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Sun, 06 Feb 2022 01:01:07 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 12B7
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8645764599013987625&gdpr=0&gdpr_consent=&us_privacy=

1 B
168 B

19ms
19ms

Image
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8645764599013987625&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug004:0:529
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8645764599013987625&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 12B7
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=de71345a-edfe-429a-9e27-b13a5e9ebea0

42 B
310 B

87ms
22ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=de71345a-edfe-429a-9e27-b13a5e9ebea0
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug018:0:3189
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=de71345a-edfe-429a-9e27-b13a5e9ebea0
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 313

GET
H2 200 buyers Show response
dmx.districtm.io/s/v1/ Frame 034D 649 B
928 B 79ms
65ms XHR
application/json 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/buyers?gdpr=0

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63c9421b72faf70fa699899b6c00a7a4d65b3b11afde5512ea3a151436639dcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
content-type: application/json
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6d98af66cf8b8c15-EWR
access-control-allow-headers: Origin, Content-Type

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 1886
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&gdpr=0&us_privacy=1---&khaos=KZBZNC43-2-ITLV
https://s.amazon-adsystem.com/ecm3?id=KZBZNC43-2-ITLV&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1---

43 B
556 B

39ms
38ms

Image
image/gif

209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=KZBZNC43-2-ITLV&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1---

Requested by

Protocol

HTTP/1.1

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: S2MNWS50N7WG1F8YMGVQ
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://s.amazon-adsystem.com/ecm3?id=KZBZNC43-2-ITLV&ex=d-rubiconproject.com&status=ok&gdpr=0&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
Expires: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 5F91 0
0 78ms
49ms Image
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022020101&jk=1909829915837632&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2

200

usersync
rtb.gumgum.com/ Frame E77F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&gdpr_consent=undefined&gdpr=0&us_privacy=1---&khaos=KZBZNC43-2-ITLV
https://rtb.gumgum.com/usersync?b=mag&i=KZBZNC43-2-ITLV&gdpr=0&gdpr_consent=undefined&us_privacy=1---

35 B
208 B

32ms
30ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=mag&i=KZBZNC43-2-ITLV&gdpr=0&gdpr_consent=undefined&us_privacy=1---
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://rtb.gumgum.com/usersync?b=mag&i=KZBZNC43-2-ITLV&gdpr=0&gdpr_consent=undefined&us_privacy=1---
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Expires: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 064B 645 B
847 B 94ms
39ms Document
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRCv-LquAhjhxY-9ATAB&v=APEucNXNufpNCOWC1fmBgalLTR3lefSSCbfiwFbCGy4Q8bWOYua7SVX5mOOFfDvKyOg1vZvBNaDv30huxUxg05vnf7KxoiZZpm7DUQx1BfYcJH7hhhCpzwg

Requested by

Host: 49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com
URL: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 07 Feb 2022 01:01:07 GMT
server: cafe
cache-control: private
content-length: 285
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 07 Feb 2022 01:01:07 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E545 57 KB
29 KB 121ms
67ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A3oK8vNs-yIpR3FQwJ-9Gx1X7yETFKDK-l-bhyJdy8DcHExUDE2YCmMnVfrfdGnCPmg6h3uGE4r5DZ8VnYKadXGZz6ZW1WkWJePKfQAR-xBxpDGMVy5U8lZYeXtn1iOSKOo8xIzPaWaaU_39_CSOvzM2fYAQ&dbm_d=AKAmf-CZlo9Ys7Wdnr6TvTemfyZD-H1QJGuXjhgw64XAHmhM0WcYGYAm_TDgcKJgm-1a1stIi0FuMKG36Xx6I1AiNA762ZOtk1JToeD2xBiG-EPWAid2GuGeetL1rAt3Xrmt6EHaXmceP3gIKmD4pJ2EdGczbjQKjIQmFHoprUE5SKfT8WzCVHaF9j7Fx4a9FBho3VAsJ4bKyBT-tg5885aZuKcyasOegLnAJelqmosQquPTxFyWmuOq8sPSOED87yGQZ-uMFyunKCAwSrzZXFdkyxfuL0K2eqXeX6RRY8NfYT7uZkmbkauBcc_YxSAmcTqlhXaPyohYIXXZk2DxaDU0Tx8X4J1PkoXG-fRgEacG81spIzW8FHe8vftFYOxP91ISelWWd8P2nAVtXMNMzW8p-QC3tY9_Pg84ukpuauq_8Q1Mdz62lb2WLAgiMvzh5_cM3GI4MLRHrt5qBARY2obggo3oNX6ZJfyZ9TMfSJ0oF7F9u-cG0SBO6rqmboaUCSXVi5E5JRYLVEgVZ86cxlrMMuUuBy9E1sN-FBcAXbWIps0l8phbXfXqxCqoNlTYPCxoWhaWjAyMdOdBCEB5sreBAL08nMjTbxn6vYWbfmorEsa0Edtx9MH4dnRcGp0yqGWyq5E3rnRT8l8v9q_D-MbvE4O4bxxBIvyY7Gyc9-zCHDE-nGhdLaTN4u7bllAScXXZqAqXwkIMJnQztwhxHj84NViu7Y8wDYcMIwzAb8mFrT92sSDuZyV6N4g5COgrSLk-ehXOsq8Lmzfxp6HKjM1tYxy34fpab7SbK1ApvzL71DYIcIRiuM1HtmRUAscCGSJYOj19XmyCRFgSeBrGncDMNgqaSmpi03F0FZ9FZBoyPEfIkZbg8qq4jd-HDtfVPN7YNDwdLZi1jVXmF_MA1dr7u_ongIGFpY2_p1Gfk-QZxVGl6TMVumrju9ou3xwcFtDknYseAmKnzRv7t_ECQ2eY6ZsT2u8ulv1NTVhL61eMthMOy15Zg2vbSoONLWA_Z277Gxwab4hYiYtopQHIIovOOpGOiuky-Ju4Mq4oyJ__FRF_rAzWxtyFOv3qyjKwE2TXQqnn8_z-7-5GEMB2aa23CGH_M7AYUEClR1xMlAU8wZnylaOOm0ORx4cHKjNdoa2gMrtfPGuH7YDJ8NpHbHp0j17CGQbxGl1LxW69ayez5yjrSt8CUYvzE9ipBMuFQyS0DRs0EU1UE2PQARSVAFBGiFttLg9uZ-gsy6nh19g6bB0ggLWEPwcKM7NM4VsScbtY7cGeNChSlgMW6y8ucSM0Rl7CImen2aT7FJt1-_tY-BRtBTf5AwUv6HYz0-oIeSGQ6Y2bFjYQoFqoNsyp3HMGRqp9UPZqjK-r2IFsE68Bp1o4VQhpLh8nCK56ieldcTPaWTDmmK2WmXa3od8cf2XN3ARYgzZYWEamv8T_2fHuPK92cErW182k7D-8T-pPnLZEKYD9p_Ohfw1xvwoCwH7R5WNFhjiXcGoG3v9aiRhhvjXGXGtfJmvbckKryPRqZftkXRLZQUpcv2n86GNpZPin0flDIikw6CwTjKzhpn7hwy3KTo_qXsu8lbzxpKyXiEUFv0hQN-nSyt-DwgAy4YO3smQjYvEePJ_tmQMEu6YWpdJvWJX9w3LnBUgruaFKyXxSgsfPcMbcAJx1ZD_VvYw_-tP_xaA1fSiR5b8-SLpRzSsK1KHMTSNMBZx1kISUapRGdbax5_J21LIzgdnSDIoWXHSoYec3CQiK5kfNLQVfy8LazJKtEIOMHUtGHzcPp6Wf7NcvLMe-W1lo9_XdF00yLTufBowcZxQY01LbMhM-4IbQ8ica2EB2s7vVzplLWS0Quf-GA6UhPhcvn5bvxLq9dxeem8cquohcTrITvesJvYJm35BaLPz2Xi0UuWvs3EpAJiFrfRIhmQa9a512kzOh43SZPRkuYNPTYKBFlbHQTq4znCzYxR_3fyca2ZUEcPEoaJ5M6aefk_2Ulq79HB0yVXefpupBK7YSiBrEt-eJILt5LoIV2KMr-dXemrQ4A3rfYW2V4a4K0bw-WYQCFkebpbISlZdMZa50gDT0oQC_pSHA726Nef7WwHdagsfFy5PBT_ZSGYgdgip7_azjXuxMWdGgrQSPJ9RDYVB3LMitptS5l8BYcaJHQ4iTKCA-l7k0KEYyuSkgGqODYhohhq1TxNCuxR0TS1f_eqAWB405BaWq8fECbNRsn76Rn5tEGCBsrebQeqe6W2aYZ9fQzst158kaMtEDzM6B2OSN1NkPGY9WB_9m5QGSHICvvNjm-yeaRtUs8P1Is6xU_ztUNnOvASjKOF1YHkzcJgSgwPFwExxRngTLxCMDH8vnIJqHUey73N06bADfSAxUokyneVCnD3KnZhWLvChgDFuWYx101tvef4gxzNDNmUPTXXHzDiic73NwYRXIqvJCIO-2mFtxC1xFqVEHTiBJl3mrXTw5aNFQVlHAcyAu80PEIu3gqeyzqk7b7Rz8B1wyX1VJfPH4FuRjkhutXZBrUFbJtTitNo7lg1308ou-i2xjvigkjBRZ4qNcLrzPFkayR6jLV-Yo77FDV-ANxRjHsHKUp9ARoiOqsqwtEOrKRcxerQpgNchksHdrqKNhu36Fa3rX9QZmaQjaA7P5HrCNcBrpC-cdG-WXi9DxIdmlxxG2guGghA1fVfljHCRCLu4HIqrrDsAwvzpuMg9EJCcfOEpS62vFuEIkvSl_8HmuXYZ1nwsU9RQzYJg6lT3dCydnv3V6jet9uXbHL5ALJYm4uOvSOlY2RdFkspxpVqR_iirBZe0QqjiKR0e0TXKhM3bNjiLNZCwXm9x5Mxd2fD5XGCK7a-GD3Nz5pK181BkNIAVkAB4FqC60_vHxT86K-DnFR2Wrcs8fdj1Bv1wzIkDHDEmEdsRNq5kWWuaBKLqeXeK9hUMj_oUg_IYGMxXmD6XPzIZ667ACzMqMkuh37nqx-0QWGXlgBKqzZowOpVzUH3nBI_BAbuhdNQV22xCZSX5YSghM07cZyOSG4ek3Qn0td19XCURYFpcuARIhSy_ScpFXzsPWvv9Su5bzy3bmrJYERD82Ga7czg5LetRzpZRfZ3CeQXlpRurPix2V5pY7c-TammVVRfCjujgIbahVG6Zs__mrdpnn3Oo6WjtdqXBn6C6PlPUIN6XhSHPzd5OdZ8F8LZt8IvWknZQ0HQ1aIbLBsHNoE_c4kld1bjjzvPwY7F4RxVxa9CuE08lJlDWeGjESiMiljaTKcHFcYZ2z_RTku116FGbKiDfTsbt6tw&cid=CAASFeRoyRy8BgAtHdoRgynTAPjL-ZpQGA&rfl=1%2Chttps%253A%252F%252Fcreate.cprewritten.net%252F%240

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b929a53bfd6b3b1dcd9a1939067faf84653cdfbdd586d8455d9fd60c118a7067

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29037
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E545 42 B
63 B 93ms
78ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ABfoftJyWwe7B4VzFrxz00RspopG76b5Vr5YOf7YLqHfbFKPzg0_DKhk_VWyGgkzTXjkyEszBAnFXE3tCprqQp5SJvu83nxUfpYGGkw9dHI8yPkoE

Requested by

Host: 49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com
URL: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220201/r20110914/client/ Frame E545 2 KB
1 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220201/r20110914/client/window_focus_fy2019.js

Requested by

Host: 49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com
URL: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 00:53:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 444
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Feb 2022 00:53:43 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E545 123 KB
38 KB 101ms
48ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com
URL: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3a6fb9e39c82eed501889521b19cc4fc13d1104f83128928775b520c86f8abc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38146
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1643806174374025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 07 Feb 2022 01:01:07 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220201/r20110914/client/ Frame E545 14 KB
6 KB 21ms
21ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220201/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com
URL: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

80182a21e69d7232583dcf7b19a5cfb9a597e7adbcc22f1a14e4096d8602612d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 00:58:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 12229469669374805284
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Feb 2022 00:58:00 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame E545 0
0 70ms
36ms Image
text/html 2607:f8b0:4006:816::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTFngv9cPULuNSGUmaNPRAVFM2WQLyl6ss2tPcszeOa2GCoWrYScjPoJw_6yHn_3UfKlQ5A0pMkVbI0Vjlt7dDpzzLJuA
Requested by: Host: 49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com
URL: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:816::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

POST
H3 204 edge Show response
cmp.uniconsent.com/v2/ 0
549 B 124ms
124ms XHR
application/json 2606:4700:3035::6815:20af
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.uniconsent.com/v2/edge
Requested by: Host: cmp.uniconsent.com
URL: https://cmp.uniconsent.com/v2/main.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:20af , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0CufqSetq6ufFKCzwW1iAhIPPVBO%2Bpq5Lhn6776sSLzV%2FmAjT2bMarUsR5WDCOlZbnd9N7Rd6Piz2IJ9d0wLeqboDXvJ%2BFEki%2F52tNW%2FI8%2Bf9PoDodDdISkN6MxBHw6Bh6G5%2BOv6wHXouEGhIFw%2BjxY%3D"}],"group":"cf-nel","max_age":604800}
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 6d98af671e06ecf2-YUL
access-control-allow-headers: Content-Type
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 09A3
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
554 B

20ms
19ms

Document
text/html

23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: about:blank

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 07 Feb 2022 01:01:07 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

server: AkamaiGHost
content-length: 0
location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
date: Mon, 07 Feb 2022 01:01:07 GMT
access-control-allow-credentials: true
access-control-allow-origin: *

GET
H2

200

usersync
rtb.gumgum.com/ Frame 26DB
Redirect Chain

https://ssc-cms.33across.com/ps/?_=1644195666625.&ri=0013300001r0t9mAAA&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
https://rtb.gumgum.com/usersync?b=tta&i=1889320954033

35 B
208 B

32ms
30ms

Image
image/gif

52.207.96.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=tta&i=1889320954033
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
Protocol: H2
Server: 52.207.96.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-96-24.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 100000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://rtb.gumgum.com/usersync?b=tta&i=1889320954033
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 26DB
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://pixel.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=the33across&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=the33across&gdpr=0&user_id=yRRIqMlATarSRUz8zh5VoMgVHfnSEh35y0chF5pi
https://ssc-cms.33across.com/ps/?gdpr_consent=&ri=10&ru=https%3A%2F%2Fcms-xch.33across.com%2Fmatch%3Fgdpr_58%3D%24gdpr_58%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26bidder_id%3...
https://cms-xch.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=71752e87-3832-4eac-809a-985a64d26fbc
https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=71752e87-3832-4eac-809a-985a64d26fbc

68 B
127 B

115ms
114ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=71752e87-3832-4eac-809a-985a64d26fbc
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

location: https://cms-xch-chicago.33across.com:443/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=71752e87-3832-4eac-809a-985a64d26fbc
date: Mon, 07 Feb 2022 01:01:07 GMT
server: awselb/2.0
content-length: 134
content-type: text/html

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 26DB
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1644195666625.4&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fc...
https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D
https://cms-xch-chicago.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=30bf6200-6f52-4100-a005-c1ed9289aa7e

68 B
127 B

62ms
28ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=30bf6200-6f52-4100-a005-c1ed9289aa7e
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

Date: Mon, 07 Feb 2022 01:01:07 GMT
Server: MT3 4133 baa842e master iad-pixel-x29 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cms-xch-chicago.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=30bf6200-6f52-4100-a005-c1ed9289aa7e
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 07 Feb 2022 01:01:06 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 26DB
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-RFtpARhE2uG8pr2edXWubi8eikQgO_mK~A
https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-RFtpARhE2uG8pr2edXWubi8eikQgO_mK%7EA&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

208ms
208ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-RFtpARhE2uG8pr2edXWubi8eikQgO_mK%7EA&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-RFtpARhE2uG8pr2edXWubi8eikQgO_mK%7EA&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 26DB
Redirect Chain

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=522459806dd21216&is_secure=true&networkId=78390&version=1&us_privacy=
https://ssc-cms.33across.com/ps?xi=64&xu=AAAGbUjMVg5JugM6PlSvAAAAAAA&expiration=1644282067&is_secure=true&us_privacy=
https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGbUjMVg5JugM6PlSvAAAAAAA&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

107ms
106ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGbUjMVg5JugM6PlSvAAAAAAA&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGbUjMVg5JugM6PlSvAAAAAAA&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 26DB
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy=
https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1646787667%26external_user_id%3Dde71345a-edfe-429a-9e27-b13a5e9ebea0
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1646787667&external_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0

68 B
213 B

62ms
27ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1646787667&external_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 40000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1646787667&external_user_id=de71345a-edfe-429a-9e27-b13a5e9ebea0
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

setuid
mp.4dex.io/
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=194558&us_privacy=1---&cb=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Dindexexchange%26us_privacy%3D1---%26uid%3D
https://mp.4dex.io/setuid?bidder=indexexchange&us_privacy=1---&uid=YgBvUjbsKtG9r1wKyiASNgAAABcAAAAB

0
408 B

103ms
102ms

Image
text/plain

2606:4700::6812:272
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mp.4dex.io/setuid?bidder=indexexchange&us_privacy=1---&uid=YgBvUjbsKtG9r1wKyiASNgAAABcAAAAB
Protocol: H2
Server: 2606:4700::6812:272 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
cache-control: no-cache, no-store, must-revalidate
cf-ray: 6d98af677cc04bc5-YUL
content-length: 0
expires: 0

Redirect headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://mp.4dex.io/setuid?bidder=indexexchange&us_privacy=1---&uid=YgBvUjbsKtG9r1wKyiASNgAAABcAAAAB
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 291
Expires: Mon, 07 Feb 2022 01:01:07 GMT

GET
H3 200 p5pfDMP4zN8jVfivP4NR4mykoq9SVPpSA9fyNGtv4o4.js Show response
pagead2.googlesyndication.com/bg/ Frame 00BF 36 KB
14 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/p5pfDMP4zN8jVfivP4NR4mykoq9SVPpSA9fyNGtv4o4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a79a5f0cc3f8ccdf2355f8af3f8351e26ca4a2af5254fa5203d7f2346b6fe28e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 06 Feb 2022 19:31:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19769
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13808
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 12:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 06 Feb 2023 19:31:38 GMT

GET
H2

200

y-sNqXUUFE2uFAAZMOreygODtuxnB33KxO~A~UP6e52e484-87b1-11ec-8865-0248f07108fb Show response
dmx.districtm.io/s/10051/ Frame 034D
Redirect Chain

https://pixel.advertising.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true
https://pixel.advertising.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/58270/sync?&gdpr=&gdpr_consent=&redir=true&apid=UP6e52e484-87b1-11ec-8865-0248f07108fb
https://dmx.districtm.io/s/10051/y-sNqXUUFE2uFAAZMOreygODtuxnB33KxO~A~UP6e52e484-87b1-11ec-8865-0248f07108fb

131 B
186 B

63ms
62ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10051/y-sNqXUUFE2uFAAZMOreygODtuxnB33KxO~A~UP6e52e484-87b1-11ec-8865-0248f07108fb

Requested by

Protocol

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a48e663a049a22cf8d67bb3bb0100a7d2dc17a2b513eaacb65a8dd99a26fd19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Mon, 07 Feb 2022 01:01:07 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6d98af68fbee8c15-EWR

Redirect headers

location: https://dmx.districtm.io/s/10051/y-sNqXUUFE2uFAAZMOreygODtuxnB33KxO~A~UP6e52e484-87b1-11ec-8865-0248f07108fb
date: Mon, 07 Feb 2022 01:01:07 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

645441767744 Show response
dmx.districtm.io/s/10022/ Frame 034D
Redirect Chain

https://ums.acuityplatform.com/tum?umid=137&rurl=https%3A%2F%2Fdmx.districtm.io%2Fs%2F10022%2F___AUID___
https://dmx.districtm.io/s/10022/645441767744

68 B
123 B

83ms
81ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10022/645441767744

Requested by

Protocol

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4b4aa8f395daddbb1ab9d1e2e7e6bd0311dcd8f1edba49a7f4228c6246cb739

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Mon, 07 Feb 2022 01:01:07 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6d98af683ab18c15-EWR

Redirect headers

Access-Control-Allow-Origin: *
Content-Length: 0
Location: https://dmx.districtm.io/s/10022/645441767744

GET
H/1.1

200
OK

sync Show response
x.bidswitch.net/ Frame 034D
Redirect Chain

https://x.bidswitch.net/sync?ssp=districtm&user_id=24lCDZJoCmwwPqWAfGzxpLmqMY1
https://ums.acuityplatform.com/bum?tpid=29&uid=71752e87-3832-4eac-809a-985a64d26fbc&bidswitch_ssp_id=districtm
https://x.bidswitch.net/sync?dsp_id=236&user_id=645441716633&expires=30&user_group=1&ssp=DistrictM

43 B
235 B

37ms
36ms

Script
image/gif

35.211.178.172
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://x.bidswitch.net/sync?dsp_id=236&user_id=645441716633&expires=30&user_group=1&ssp=DistrictM
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: HTTP/1.1
Server: 35.211.178.172 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e2d868f56353cfa8f98f458b5bb7edf7585e67750a7dc681947d86c10f680499

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 07 Feb 2022 01:01:07 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Access-Control-Allow-Origin: *
Content-Length: 0
Location: https://x.bidswitch.net/sync?dsp_id=236&user_id=645441716633&expires=30&user_group=1&ssp=DistrictM

GET
H2

200

AAAGbUjMVg5JtwNIMccsAAAAAAA&expiration=1644282067&nuid=24lCDZJoCmwwPqWAfGzxpLmqMY1&is_secure=true Show response
dmx.us-east-31.districtm.io/s/10007/ Frame 034D
Redirect Chain

https://districtm-match.dotomi.com/match/bounce/current?version=1&networkId=33921&nuid=24lCDZJoCmwwPqWAfGzxpLmqMY1&rurl=//dmx.us-east-31.districtm.io/s/10007/
https://districtm-match.dotomi.com/match/bounce/current?DotomiTest=24654c9f9ab01215&is_secure=true&version=1&networkId=33921&nuid=24lCDZJoCmwwPqWAfGzxpLmqMY1&rurl=%2F%2Fdmx.us-east-31.districtm.io%...
https://dmx.us-east-31.districtm.io/s/10007/AAAGbUjMVg5JtwNIMccsAAAAAAA&expiration=1644282067&nuid=24lCDZJoCmwwPqWAfGzxpLmqMY1&is_secure=true

153 B
291 B

127ms
39ms

Script
application/javascript

34.75.117.5
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.us-east-31.districtm.io/s/10007/AAAGbUjMVg5JtwNIMccsAAAAAAA&expiration=1644282067&nuid=24lCDZJoCmwwPqWAfGzxpLmqMY1&is_secure=true

Requested by

Protocol

Server

34.75.117.5 North Charleston, United States, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

5.117.75.34.bc.googleusercontent.com

Software

Resource Hash

2ae9a070ae6f82129d3355764872eecfd707d4c88793ea8cd5ad8ab939dff2da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
content-length: 153
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: //dmx.us-east-31.districtm.io/s/10007/AAAGbUjMVg5JtwNIMccsAAAAAAA&expiration=1644282067&nuid=24lCDZJoCmwwPqWAfGzxpLmqMY1&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341 Show response
dmx.districtm.io/s/10001/ Frame 034D
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=96
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=96
https://dmx.districtm.io/s/10001/74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341

106 B
189 B

57ms
57ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10001/74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341

Requested by

Protocol

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5405495c3687ad9ca155a9feaa78e204729b1661693d1bf5b3b30495ad225c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Mon, 07 Feb 2022 01:01:07 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6d98af685afd8c15-EWR

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://dmx.districtm.io/s/10001/74463b2b-f939-456e-91a0-5efa15aa6b0c-62006f53-4341
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 200 709414.gif
id.rlcdn.com/ Frame 1886 42 B
317 B 52ms
41ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif?gdpr=0&us_privacy=1---
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Feb 2022 01:01:07 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 1886
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D&gdpr=0&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=30bf6200-6f52-4100-a005-c1ed9289aa7e&expires=28

42 B
720 B

81ms
23ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=30bf6200-6f52-4100-a005-c1ed9289aa7e&expires=28
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Content-Type: image/gif

Redirect headers

Date: Mon, 07 Feb 2022 01:01:07 GMT
Server: MT3 4133 baa842e master iad-pixel-x9 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=30bf6200-6f52-4100-a005-c1ed9289aa7e&expires=28
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 07 Feb 2022 01:01:06 GMT

GET
H/1.1

422
Unprocessable Entity

tap.php
pixel.rubiconproject.com/ Frame 1886
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHMovqcTjQaXTEN1lrmVl84&google_cver=1

0
0

64ms
26ms

Image
text/plain

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHMovqcTjQaXTEN1lrmVl84&google_cver=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEHMovqcTjQaXTEN1lrmVl84&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 337
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 1886
Redirect Chain

https://token.rubiconproject.com/token?pid=26594&gdpr=0&us_privacy=1---
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZBZNC43-2-ITLV&sigv=1&esig=2~27ba697e78ce8237190681d99da29dc5a4d19147&gdpr=0&us_privacy=1---

0
194 B

115ms
32ms

Image
text/plain

2001:4998:14:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZBZNC43-2-ITLV&sigv=1&esig=2~27ba697e78ce8237190681d99da29dc5a4d19147&gdpr=0&us_privacy=1---

Requested by

Protocol

Server

2001:4998:14:800::1000 Ashburn, United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZBZNC43-2-ITLV&sigv=1&esig=2~27ba697e78ce8237190681d99da29dc5a4d19147&gdpr=0&us_privacy=1---
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 368ba1c92c09ff88b641150fbbf94341
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 1886
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?gdpr=0&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=&expires=30

42 B
720 B

89ms
25ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=de71345a-edfe-429a-9e27-b13a5e9ebea0&gdpr=0&gdpr_consent=&expires=30
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 289

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 1886
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&gdpr=0&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgBvUgAEUHzwywBH&gdpr=0&us_privacy=1---

42 B
720 B

63ms
25ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgBvUgAEUHzwywBH&gdpr=0&us_privacy=1---
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1644195667.160334,VS0,VE0
x-served-by: cache-yul12820-YUL
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgBvUgAEUHzwywBH&gdpr=0&us_privacy=1---
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 1886
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0&us_privacy=1---
https://pr-bh.ybp.yahoo.com/sync/rubicon/AU4wAVlxOWOq-Xj1-Uq_LA?csrc=&gdpr=0&us_privacy=1---
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=791549314977830494

42 B
720 B

26ms
26ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=791549314977830494
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-LoopMe_ox-db5_smrt_n-inmobi_dmx_n-smaato_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&gdpr=0
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Content-Type: image/gif

Redirect headers

date: Mon, 07 Feb 2022 01:01:07 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=791549314977830494
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1886
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&gdpr=0&us_privacy=1---
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pCWk5DNDMtMi1JVExW&gdpr=0&us_privacy=1---

170 B
188 B

44ms
44ms

Image
image/png

172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pCWk5DNDMtMi1JVExW&gdpr=0&us_privacy=1---

Requested by

Protocol

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pCWk5DNDMtMi1JVExW&gdpr=0&us_privacy=1---
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: ad49a0f18e050afeb6359164ab3bd56e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 09A3 32 KB
10 KB 22ms
21ms Script
text/html 23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 9063e9df2b2c8b49b8f7314f9dfb196e53c9f92c342a5419604801f7774a1d24

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 07 Feb 2022 01:01:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Dec 2021 23:04:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=75731
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9702
Expires: Mon, 07 Feb 2022 22:03:18 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 064B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1&gdpr=0

43 B
1 KB

27ms
27ms

Image
image/gif

184.29.129.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRCv-LquAhjhxY-9ATAB&v=APEucNXNufpNCOWC1fmBgalLTR3lefSSCbfiwFbCGy4Q8bWOYua7SVX5mOOFfDvKyOg1vZvBNaDv30huxUxg05vnf7KxoiZZpm7DUQx1BfYcJH7hhhCpzwg
Protocol: HTTP/1.1
Server: 184.29.129.7 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-129-7.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 07 Feb 2022 01:01:07 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1&gdpr=0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 064B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YgBvUjbsKtG9r1wKyiASNgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1

43 B
1 KB

36ms
36ms

Image
image/gif

184.29.129.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRCv-LquAhjhxY-9ATAB&v=APEucNXNufpNCOWC1fmBgalLTR3lefSSCbfiwFbCGy4Q8bWOYua7SVX5mOOFfDvKyOg1vZvBNaDv30huxUxg05vnf7KxoiZZpm7DUQx1BfYcJH7hhhCpzwg
Protocol: HTTP/1.1
Server: 184.29.129.7 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-129-7.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 07 Feb 2022 01:01:07 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENAOz_beime1imNy4JkY5hY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 064B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEH8fcMYNwiW1QaPqyx18nyI&google_cver=1

43 B
1005 B

71ms
71ms

Image
image/gif

68.67.179.113
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEH8fcMYNwiW1QaPqyx18nyI&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRCv-LquAhjhxY-9ATAB&v=APEucNXNufpNCOWC1fmBgalLTR3lefSSCbfiwFbCGy4Q8bWOYua7SVX5mOOFfDvKyOg1vZvBNaDv30huxUxg05vnf7KxoiZZpm7DUQx1BfYcJH7hhhCpzwg

Protocol

HTTP/1.1

Server

68.67.179.113 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 1f1ec6fa-850b-4faa-9925-964cd3965713
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEH8fcMYNwiW1QaPqyx18nyI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 064B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAyMTE2NTk2MTg5MzI5ODkw

170 B
188 B

45ms
45ms

Image
image/png

172.217.165.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAyMTE2NTk2MTg5MzI5ODkw

Requested by

Protocol

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 36077f88-d39e-4cd7-873a-e2e26eba998e
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAyMTE2NTk2MTg5MzI5ODkw
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220201/r20110914/ Frame E545 24 KB
9 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220201/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A3oK8vNs-yIpR3FQwJ-9Gx1X7yETFKDK-l-bhyJdy8DcHExUDE2YCmMnVfrfdGnCPmg6h3uGE4r5DZ8VnYKadXGZz6ZW1WkWJePKfQAR-xBxpDGMVy5U8lZYeXtn1iOSKOo8xIzPaWaaU_39_CSOvzM2fYAQ&dbm_d=AKAmf-CZlo9Ys7Wdnr6TvTemfyZD-H1QJGuXjhgw64XAHmhM0WcYGYAm_TDgcKJgm-1a1stIi0FuMKG36Xx6I1AiNA762ZOtk1JToeD2xBiG-EPWAid2GuGeetL1rAt3Xrmt6EHaXmceP3gIKmD4pJ2EdGczbjQKjIQmFHoprUE5SKfT8WzCVHaF9j7Fx4a9FBho3VAsJ4bKyBT-tg5885aZuKcyasOegLnAJelqmosQquPTxFyWmuOq8sPSOED87yGQZ-uMFyunKCAwSrzZXFdkyxfuL0K2eqXeX6RRY8NfYT7uZkmbkauBcc_YxSAmcTqlhXaPyohYIXXZk2DxaDU0Tx8X4J1PkoXG-fRgEacG81spIzW8FHe8vftFYOxP91ISelWWd8P2nAVtXMNMzW8p-QC3tY9_Pg84ukpuauq_8Q1Mdz62lb2WLAgiMvzh5_cM3GI4MLRHrt5qBARY2obggo3oNX6ZJfyZ9TMfSJ0oF7F9u-cG0SBO6rqmboaUCSXVi5E5JRYLVEgVZ86cxlrMMuUuBy9E1sN-FBcAXbWIps0l8phbXfXqxCqoNlTYPCxoWhaWjAyMdOdBCEB5sreBAL08nMjTbxn6vYWbfmorEsa0Edtx9MH4dnRcGp0yqGWyq5E3rnRT8l8v9q_D-MbvE4O4bxxBIvyY7Gyc9-zCHDE-nGhdLaTN4u7bllAScXXZqAqXwkIMJnQztwhxHj84NViu7Y8wDYcMIwzAb8mFrT92sSDuZyV6N4g5COgrSLk-ehXOsq8Lmzfxp6HKjM1tYxy34fpab7SbK1ApvzL71DYIcIRiuM1HtmRUAscCGSJYOj19XmyCRFgSeBrGncDMNgqaSmpi03F0FZ9FZBoyPEfIkZbg8qq4jd-HDtfVPN7YNDwdLZi1jVXmF_MA1dr7u_ongIGFpY2_p1Gfk-QZxVGl6TMVumrju9ou3xwcFtDknYseAmKnzRv7t_ECQ2eY6ZsT2u8ulv1NTVhL61eMthMOy15Zg2vbSoONLWA_Z277Gxwab4hYiYtopQHIIovOOpGOiuky-Ju4Mq4oyJ__FRF_rAzWxtyFOv3qyjKwE2TXQqnn8_z-7-5GEMB2aa23CGH_M7AYUEClR1xMlAU8wZnylaOOm0ORx4cHKjNdoa2gMrtfPGuH7YDJ8NpHbHp0j17CGQbxGl1LxW69ayez5yjrSt8CUYvzE9ipBMuFQyS0DRs0EU1UE2PQARSVAFBGiFttLg9uZ-gsy6nh19g6bB0ggLWEPwcKM7NM4VsScbtY7cGeNChSlgMW6y8ucSM0Rl7CImen2aT7FJt1-_tY-BRtBTf5AwUv6HYz0-oIeSGQ6Y2bFjYQoFqoNsyp3HMGRqp9UPZqjK-r2IFsE68Bp1o4VQhpLh8nCK56ieldcTPaWTDmmK2WmXa3od8cf2XN3ARYgzZYWEamv8T_2fHuPK92cErW182k7D-8T-pPnLZEKYD9p_Ohfw1xvwoCwH7R5WNFhjiXcGoG3v9aiRhhvjXGXGtfJmvbckKryPRqZftkXRLZQUpcv2n86GNpZPin0flDIikw6CwTjKzhpn7hwy3KTo_qXsu8lbzxpKyXiEUFv0hQN-nSyt-DwgAy4YO3smQjYvEePJ_tmQMEu6YWpdJvWJX9w3LnBUgruaFKyXxSgsfPcMbcAJx1ZD_VvYw_-tP_xaA1fSiR5b8-SLpRzSsK1KHMTSNMBZx1kISUapRGdbax5_J21LIzgdnSDIoWXHSoYec3CQiK5kfNLQVfy8LazJKtEIOMHUtGHzcPp6Wf7NcvLMe-W1lo9_XdF00yLTufBowcZxQY01LbMhM-4IbQ8ica2EB2s7vVzplLWS0Quf-GA6UhPhcvn5bvxLq9dxeem8cquohcTrITvesJvYJm35BaLPz2Xi0UuWvs3EpAJiFrfRIhmQa9a512kzOh43SZPRkuYNPTYKBFlbHQTq4znCzYxR_3fyca2ZUEcPEoaJ5M6aefk_2Ulq79HB0yVXefpupBK7YSiBrEt-eJILt5LoIV2KMr-dXemrQ4A3rfYW2V4a4K0bw-WYQCFkebpbISlZdMZa50gDT0oQC_pSHA726Nef7WwHdagsfFy5PBT_ZSGYgdgip7_azjXuxMWdGgrQSPJ9RDYVB3LMitptS5l8BYcaJHQ4iTKCA-l7k0KEYyuSkgGqODYhohhq1TxNCuxR0TS1f_eqAWB405BaWq8fECbNRsn76Rn5tEGCBsrebQeqe6W2aYZ9fQzst158kaMtEDzM6B2OSN1NkPGY9WB_9m5QGSHICvvNjm-yeaRtUs8P1Is6xU_ztUNnOvASjKOF1YHkzcJgSgwPFwExxRngTLxCMDH8vnIJqHUey73N06bADfSAxUokyneVCnD3KnZhWLvChgDFuWYx101tvef4gxzNDNmUPTXXHzDiic73NwYRXIqvJCIO-2mFtxC1xFqVEHTiBJl3mrXTw5aNFQVlHAcyAu80PEIu3gqeyzqk7b7Rz8B1wyX1VJfPH4FuRjkhutXZBrUFbJtTitNo7lg1308ou-i2xjvigkjBRZ4qNcLrzPFkayR6jLV-Yo77FDV-ANxRjHsHKUp9ARoiOqsqwtEOrKRcxerQpgNchksHdrqKNhu36Fa3rX9QZmaQjaA7P5HrCNcBrpC-cdG-WXi9DxIdmlxxG2guGghA1fVfljHCRCLu4HIqrrDsAwvzpuMg9EJCcfOEpS62vFuEIkvSl_8HmuXYZ1nwsU9RQzYJg6lT3dCydnv3V6jet9uXbHL5ALJYm4uOvSOlY2RdFkspxpVqR_iirBZe0QqjiKR0e0TXKhM3bNjiLNZCwXm9x5Mxd2fD5XGCK7a-GD3Nz5pK181BkNIAVkAB4FqC60_vHxT86K-DnFR2Wrcs8fdj1Bv1wzIkDHDEmEdsRNq5kWWuaBKLqeXeK9hUMj_oUg_IYGMxXmD6XPzIZ667ACzMqMkuh37nqx-0QWGXlgBKqzZowOpVzUH3nBI_BAbuhdNQV22xCZSX5YSghM07cZyOSG4ek3Qn0td19XCURYFpcuARIhSy_ScpFXzsPWvv9Su5bzy3bmrJYERD82Ga7czg5LetRzpZRfZ3CeQXlpRurPix2V5pY7c-TammVVRfCjujgIbahVG6Zs__mrdpnn3Oo6WjtdqXBn6C6PlPUIN6XhSHPzd5OdZ8F8LZt8IvWknZQ0HQ1aIbLBsHNoE_c4kld1bjjzvPwY7F4RxVxa9CuE08lJlDWeGjESiMiljaTKcHFcYZ2z_RTku116FGbKiDfTsbt6tw&cid=CAASFeRoyRy8BgAtHdoRgynTAPjL-ZpQGA&rfl=1%2Chttps%253A%252F%252Fcreate.cprewritten.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df94b6cedc01499d102054bb635b49f063b916765bee0c6dc1799e0ef46c217e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 00:56:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9508
x-xss-protection: 0
server: cafe
etag: 7436944165253170378
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Feb 2022 00:56:42 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220201/r20110914/elements/html/ Frame E545 8 KB
3 KB 21ms
19ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220201/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 00:58:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 154
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Feb 2022 00:58:33 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E545 0
571 B 192ms
134ms Ping
image/gif 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstRQAGjfoF2VIql-EJZwUASukWNHYNiRAt_d_1k-XL76r-hlojFMHApLXjtmmbX-IgHaMPyNHpdJ9oOxgDHt-oKp2Wbm4qlATjSAIQ6cwwbd_OQ8DOA0czBWV5FST8R9SrwoFtExmKuJ5AavjUrL_U3qBj0g6fFj2ybdopR_-9FjWN9iEFzhzlMYc8CDTsh1uHSjuE4uoQob8isRoESPmeznBQ4TtuhHnxtsWH7p7eFMxNbEo1J4QbVq-CuKcA01-preOHl0As567C6b1DJ2oIHm39FhX4MFm6MhCokiW8gZ0AeZj2Mvrop_xDVhRMeJ9Dz7bz0hQzE1rUMv5XTh8Dc-1s3a4ncq8n2YyBzGxTqOokzJAgrfvU60_4awh9hjrJptnqtiLaocRsSkOfjWQKdeMlJMq6VU4ri55x6zPwvaYHeDebtS-07-ZjrxSLX-aErGfh9r5Mui6qE9-SYe-heLAraOd_echfRp2WNM_WXfmWCpJkli1QQ01gYG1vJMoOZi956d6x4nlOCruO4ZE7e0l1_mU6RAegY9nWpWJNyBVPpNNHlpGRAYFYhELQXDEpn_tEdCbj-Nk3RnzPZHUqPoc4TtFjIIY3ni7pPeQpA5IsurFkQw0J9VK5l2_Rqfz-EXc2-ZBOHXXGVjWM9N0CpjnfzdOM821vK0fNZihhCn1bawbML3m__XZZR2I7kJyJGIoaSTQtxfLT9_0YZcOH8qNKt2x_VP9f4S7s2hyoh6AYlV14MA1-QTKpFyhHQK7QxBIuanztsf-ho-v8hoTysorUKAj7EwCan5TMW0mJSebXT-VEquGUi4W-y4EBF4DUEPCbUK-Rkd_7al05__nNP4AKMGWORPEphXv0EdCxVk6nEmWlYjtz4Hhyh0AxvkAI6sYikmwhnWtEMmNqOHPTOfUGrT8upcG9jtLiW0mZMtGvzHo5DbFO6u080mF8lsriV-LDx7697oPnxh9izVhKC2mj2qt53aGZd8NaxgIlXd_DxNu9BkPfI712Yglt_Vqv1clyhgIFt1zSfUOFSNHOxcAS2T4BhV7Kflwd5_-jG_aT8oEHm2RUVjsSU7kkCYwhaGaHDmxh1GjcwJO5TF3Yj4QlKdQOqvJrcjUzjSbbt3eDMUAINNDgDlyS2T1knMsgVXnYGRPMRkna08dP0KeUBE8_48aDNOdshXHolEWTTEo4ln8SkVg-3-VaPWcgFKPsErEgth-WX&sai=AMfl-YRGKgNn15T3v2PRHJUdUX2L9nDfMsXRrWcskhUie7mFz4Pp2yAgtp0CfcCKRpIp-RC8UZbwXaSEhKYgtzcw-bO0QDYmDBIk3UzTQ2clKqtSEbtAtQvu6W_SnN-ra1FUFWsCQMJvK6cCOFdSxi6IyLRI-d6cHxx-ws4wsXE&sig=Cg0ArKJSzFwJ3jh5jzNbEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220201.58583&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 07 Feb 2022 01:01:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E545 41 KB
15 KB 24ms
22ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 06 Feb 2022 17:26:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27301
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 06 Feb 2023 17:26:06 GMT

GET
H2 200 13659358196514975723
s0.2mdn.net/simgad/ Frame E545 40 KB
40 KB 104ms
23ms Image
image/jpeg 2607:f8b0:4006:824::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/13659358196514975723

Requested by

Host: 49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com
URL: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6ac74839fe4b9960558da00559a765b485ca472e66234a0a74ce6ee1a2bb2b12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 01 Feb 2022 16:35:36 GMT
x-content-type-options: nosniff
age: 462331
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40661
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 10:30:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 01 Feb 2023 16:35:36 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9643 0
0 82ms
82ms Fetch
image/gif 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu8KfC_zJzsOKcBbPZzkjvM0LVX3c85HvPkY86MmgWQklTanOrgMdan77pmhPnTKteHBDZ6Cf3OuNRDKyzf4IKG02USsxoT1E91a1de4nI3B5J6NYvDG4QvFxA9vqHna9bViqcNmE3WYJbRFdMK1E5JydeyGdd0SaAnA_PBTL53gDq4iGkm2XlXoTgqt7jfN5VH4MTQ-JPHIWIUmMF8cMb_u60mIgfLB4b49NK02FDdChOaELuu-7Ydz0gPOnS5K2o4C6PscjhgocGiQ0F5ONrIMuOKPt4kkn4qWX7KvGIgqDCWkMrQ206Y5I5sUfus38stmbHiD4s2GX4JqBBScB7JYkXI6lxm3w&sai=AMfl-YQWtoVmAHSNLEuMerj1B4sFBp5z-6zJn_J89olSLQ919NkZUh7MDX59Z33ytbB6-pPE6C19F6YdlR0swTi2sKEEAgt6Am2qjwSVk_2ZPtPzIzFpHZXD_5vUZJL3xe-p&sig=Cg0ArKJSzEyZ6VDLF0nvEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Feb 2022 01:01:07 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 9D46 13 KB
5 KB 53ms
23ms Document
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4980
x-xss-protection: 0
date: Mon, 07 Feb 2022 00:14:07 GMT
expires: Tue, 08 Feb 2022 00:14:07 GMT
cache-control: public, max-age=86400
age: 2820
etag: 12223946614886178233
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 9643 13 KB
5 KB 53ms
22ms Script
text/javascript 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

daac645dde5dd06d307539cef2bc6bea571ca3b0f7994134e73c9f9ca573c803

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 00:02:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3498
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5413
x-xss-protection: 0
server: cafe
etag: 121210388098680982
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 07 Feb 2022 01:02:49 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/222/ Frame 9643 85 KB
29 KB 74ms
17ms Script
application/x-javascript 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/222/trk.js
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 7b6fc69a9da277bb118dbe07973e75598ff107f8d5c69aec6a3e0f5e6884603a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 07 Feb 2022 01:01:07 GMT
Content-Encoding: gzip
Age: 4717162
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 29209
X-Served-By: cache-lga21947-LGA, cache-yul12829-YUL
Access-Control-Allow-Origin: *, *
Last-Modified: Tue, 14 Dec 2021 10:40:55 GMT
Server: AkamaiNetStorage
X-Timer: S1644195667.311626,VS0,VE0
ETag: "27a82a9a755fe85e7882d2ba1e990a11:1639478455.565772"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Wed, 14 Dec 2022 10:41:45 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 2, 6736487

GET
H/1.1 200
OK it
nym1-ib.adnxs.com/ Frame 9643 0
804 B 78ms
22ms Image
text/html 68.67.179.154
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fcreate.cprewritten.net%252F&e=wqT_3QKHBugHAwAAAwDWAAUBCNHegZAGEILBiOnpwsjeCxgAKjYJTb1uERjr-z8RR7fzN4AC-D8ZAAAA4HoUGUAhRw0SACkRJNAxAAAAYI_C7T8wr5enCTjhOUDlHkhlUNiiyyVYn-WJAWAAaNiroQF4qskFgAEBigEDVVNEkgUG8GGYAdQDoAE8qAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKZgVvqAh9odHRwczovL2NyZWF0ZS5jcHJld3JpdHRlbi5uZXQvgAMAiAMBkAMAmAMXoAMBqgPpAQq_ARE1cHBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tDR5EL2dlbl8yMDQ_aWQ9YXdiaWQmBQb0aQFfYj1BS0FtZi1Ed2d3ZVVUY2ZtNTdycE03cDhUU1kxUmRfdy1vRzJrLWRyLUhWRnM5S3I0UW1reHNsazNrdC04U0pnZjFzYjZzOHR3OG9iWVhLX0ZHZ05lY2NYZkJiSk9fbjg5USZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhI4NDU4Njk3ODU1MzY0MDU2MzQiCDc4ODI3ODY0KgQzOTQxOgEwwAOsAsgDANgD0NCpAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4MagEALIEDwgAEAEY1AMgPCgAMAA4ArgEAMAEAMgEANoEAggB4AQB8ATYossliAUBmAUAoAXhq_GDm_y77DfABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWwl0v6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG7o8B2gYWChAAAAAAAAUWCQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTM5MTk4MjM0NTQ0ugcRCAABKUwqBDEtLS04tARAAcgHqskF0gcNCQlHAAAFSQjaBwYJKUTgBwDqBwIIAPAHxP8HiggCEAA.&s=cf098ad996bfdd6b50c99ef703735c653c1a707c

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.154 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 574.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 2c4d45c9-4028-4343-9bc2-a70bf885604b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9643 0
20 B 82ms
78ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-DU1XgFxcPO61qNKcUsxFw33i-d7W2gLxfatFgJ04xdi8VV6k-1XkHjiMv0R2Sg451XB0oHzb-szf6RiJ49kd8EbZJ4Bg

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK proxy
pghbl1.pubgalaxy.com/ 0
0 95ms
33ms Fetch
text/html 52.204.201.175
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pghbl1.pubgalaxy.com/proxy?location=ct%3DCA%26st%3D%26city%3D0%26dma%3D0%26zp%3D%26bw%3D3&adunit_code=%2F8095840%2F.2_A.36423.3_j-cprewritten.net_tier1&provider_id=145&size=468x60&price=1.5&data_type=1&hb_channel=0&bundle_name=j-cprewrittennet_CFG1_default_new.min.js&wrapper_active=845defd5-3b77-4686-9372-0804d9f9aa3d
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.201.175 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-201-175.compute-1.amazonaws.com
Software: nginx/1.12.2 / PHP/7.0.30
Resource Hash

Request headers

Accept: application/json
Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Mon, 07 Feb 2022 01:01:07 GMT
Content-Encoding: gzip
Server: nginx/1.12.2
X-Powered-By: PHP/7.0.30
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9643 123 KB
37 KB 72ms
42ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3a6fb9e39c82eed501889521b19cc4fc13d1104f83128928775b520c86f8abc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38146
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1643806174374025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 07 Feb 2022 01:01:07 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 35DA 22 KB
8 KB 23ms
23ms Document
text/html 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 04 Feb 2022 04:35:39 GMT
expires: Sat, 04 Feb 2023 04:35:39 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 246328
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 09A3
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&gdpr_consent=undefined&gdpr=0&us_privacy=1---&khaos=KZBZNC43-2-ITLV
https://ssc-cms.33across.com/ps/?xi=1&xu=KZBZNC43-2-ITLV&gdpr=0&gdpr_consent=undefined
https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KZBZNC43-2-ITLV&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

29ms
29ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KZBZNC43-2-ITLV&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:06 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KZBZNC43-2-ITLV&ts=1644195667&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
DATA 200
OK truncated
/ Frame E545 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 836376141ebb16a0e4557227b6522cc7de90684ad1d61d9615412030b9146bbe

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9643 77 KB
29 KB 42ms
42ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

837a6b962b981d3f843dd08cf390bf3d502b80ca5433562b64833af180516ce2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29662
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1643806177083089"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 07 Feb 2022 01:01:07 GMT

GET
H/1.1 200
OK rd_log Show response
nym1-ib.adnxs.com/ Frame 9643 0
804 B 94ms
93ms Script
text/html 68.67.179.154
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fcreate.cprewritten.net%2F&e=wqT_3QL2A3z2AQAAAwDWAAUBCNHegZAGEKDftdmEmZT7fxgAKjYJAA0BABENCCgAGQAAAIAUriJAIRESACkRCfQFATEAAADgUbj2PzDcmKcJOOE5QOE5SABQAFif5YkBYABo2KuhAXiqyQWAAQGKAQCSAQNVU0SYAdgFoAFaqAEBsAEAuAEAwAEAyAEA0AEA2AEA4AEA8AEA2AIA4AKZgVvqAh9odHRwczovL2NyZWF0ZS5jcHJld3JpdHRlbi5uZXQvgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD0NCpAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4MagEALIEDwgAEAEY2AUgWigAMAA4ArgEAMAEAMgEANoEAggA4AQA8AQAiAUBmAUAoAUAwAUAyQUpDhDwP9IFCTU-aNgFAeAFAPAFAPoFBAgAEACQBgCYBgC4BgDBBgkvGAAA2gYWChARDREBXBAAGADgBgDyBgIIAIAHAYgHAKAHALoHEQFEUBgAKgQxLS0tOLQEQAHIB6rJBdIHDRVyAToI2gcGCSlE4AcA6gcCCADwB8T_B4oIAhAA&s=acabf138dc42b5c03046bc832f42464488b89a3f&bdref=https%3A%2F%2Fcreate.cprewritten.net%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fcreate.cprewritten.net%2F,https%3A%2F%2Fcreate.cprewritten.net%2F&

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.154 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 574.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 0ad78baa-cc9a-4441-ac1b-43cb0b0a07b3
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E545 0
23 B 114ms
85ms Ping
image/gif 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 07 Feb 2022 01:01:07 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 00BF 0
9 B 20ms
20ms Image
text/plain 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Ve99WQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 9D46 75 KB
30 KB 83ms
83ms XHR
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d6dfab8cbe80efe8750fb461c75c4207836546fe830e10ab912290046481130

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30247
x-xss-protection: 0

GET
H3 200 K3QqjkDtpTyrF38W5JrZ5ol4_5B02gVdFCmanKaTR4c.js Show response
pagead2.googlesyndication.com/bg/ Frame 35DA 35 KB
13 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/K3QqjkDtpTyrF38W5JrZ5ol4_5B02gVdFCmanKaTR4c.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b742a8e40eda53cab177f16e49ad9e68978ff9074da055d14299a9ca6934787

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 06 Feb 2022 17:18:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27764
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13776
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 06 Feb 2023 17:18:23 GMT

POST
H2 204 users Show response
dmx.districtm.io/s/v1/ Frame 034D 0
629 B 56ms
56ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cdn.districtm.io/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6d98af6b58c28c15-EWR
access-control-allow-headers: Origin, Content-Type

OPTIONS
H2 204 users
dmx.districtm.io/s/v1/ Frame 0
0 236ms
194ms Preflight 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://cdn.districtm.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
cf-ray: 6d98af6a2ac35413-YYZ
access-control-allow-origin: https://cdn.districtm.io
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-max-age: 14400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 9643 0
0 82ms
82ms Fetch
image/gif 142.251.40.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuTRHmbkgLHgdlae3H6c45Nsw3oz7PMWVTAcy_TadbGvT0c-S3m9jnPAc0Z8cX4oS9-oiwL1BvmGI41GwdRt7f3GNjSGtXBWt9coV2iPP9hNNnPKB_AJY0nG6BlszPUiM2t-o5cVG5kg9yroe-Ptx0nltj9PyPsR7k343SGwXN8LiSUO1G_We5a_a-eecpAHBWcbde10_L4B7e2XZPXK3Yjq3ZRgZNfQqigtKcHBLISYhhCCPMkHbrEn2tnATqARo-e-jEiA5jk4THApuPj58HOI8t1KS-u5xXUqdmW5Ds-Qs9IjvJFSxbTcUc5Dyn2fwVNHLSaLANqOC91C_Ml9tI1VonMTw9-8ZsQ&sai=AMfl-YRTU6tz1fnumE2Jyj22QBCbN_fzBLGWXGmZA9K3tSqrULvDiguZgisYSibbPoa6OmGbSCpakO_5I4HenMQxDrgo3_xAgo5szt6ChTTBm3PO9j4jPAqOsZpxrpJvl5O5&sig=Cg0ArKJSzM7_afRJkDlGEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 07 Feb 2022 01:01:07 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Mon, 07 Feb 2022 01:01:07 GMT

GET
DATA 200
OK truncated
/ Frame 9643 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ffbd2afaa823f77c72a0f861e18a49384060117b837d23de8c2449861248d148

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame 9643 0
833 B 34ms
34ms Ping
text/html 68.67.179.154
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fcreate.cprewritten.net%2F&e=wqT_3QKHBugHAwAAAwDWAAUBCNHegZAGEILBiOnpwsjeCxgAKjYJTb1uERjr-z8RR7fzN4AC-D8ZAAAA4HoUGUAhRw0SACkRJNAxAAAAYI_C7T8wr5enCTjhOUDlHkhlUNiiyyVYn-WJAWAAaNiroQF4qskFgAEBigEDVVNEkgUG8GGYAdQDoAE8qAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKZgVvqAh9odHRwczovL2NyZWF0ZS5jcHJld3JpdHRlbi5uZXQvgAMAiAMBkAMAmAMXoAMBqgPpAQq_ARE1cHBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tDR5EL2dlbl8yMDQ_aWQ9YXdiaWQmBQb0aQFfYj1BS0FtZi1Ed2d3ZVVUY2ZtNTdycE03cDhUU1kxUmRfdy1vRzJrLWRyLUhWRnM5S3I0UW1reHNsazNrdC04U0pnZjFzYjZzOHR3OG9iWVhLX0ZHZ05lY2NYZkJiSk9fbjg5USZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhI4NDU4Njk3ODU1MzY0MDU2MzQiCDc4ODI3ODY0KgQzOTQxOgEwwAOsAsgDANgD0NCpAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4MagEALIEDwgAEAEY1AMgPCgAMAA4ArgEAMAEAMgEANoEAggB4AQB8ATYossliAUBmAUAoAXhq_GDm_y77DfABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWwl0v6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG7o8B2gYWChAAAAAAAAUWCQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTM5MTk4MjM0NTQ0ugcRCAABKUwqBDEtLS04tARAAcgHqskF0gcNCQlHAAAFSQjaBwYJKUTgBwDqBwIIAPAHxP8HiggCEAA.&s=cf098ad996bfdd6b50c99ef703735c653c1a707c&type=nv&nvt=5&jm=1003&px=563&py=953&bw=468&bh=60&sid=4194147221086081172&vd=ct~0|rr~0&sv=222&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=19516335&sw=1600&sh=1200&pw=1600&ph=1438&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/222/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.154 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-34-231-145-189.compute-1.amazonaws.com

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 574.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 48797656-2f25-4133-a28d-9825868ca314
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://create.cprewritten.net
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220201/r20110914/ Frame 9D46 24 KB
9 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220201/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df94b6cedc01499d102054bb635b49f063b916765bee0c6dc1799e0ef46c217e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 00:19:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2477
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9508
x-xss-protection: 0
server: cafe
etag: 7436944165253170378
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Feb 2022 00:19:50 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220201/r20110914/client/ Frame 9D46 2 KB
1 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220201/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

272f3d0f2cce62e707f9c0686695e2adbac257d88fff6eecf1bf96f43048f935

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 00:50:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 634
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1201
x-xss-protection: 0
server: cafe
etag: 2856655861756061653
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Feb 2022 00:50:33 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9D46 123 KB
37 KB 58ms
57ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3a6fb9e39c82eed501889521b19cc4fc13d1104f83128928775b520c86f8abc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38146
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1643806174374025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 07 Feb 2022 01:01:07 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220201/r20110914/client/ Frame 9D46 18 KB
7 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220201/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

62f57d72bb43e3271cd70b5c36f816790f82e4b805aa9e9564344db3f9b999c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:00:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7255
x-xss-protection: 0
server: cafe
etag: 4210611993025098845
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 21 Feb 2022 01:00:22 GMT

GET
H3 200 one_click_handler_one_afma.js Show response
tpc.googlesyndication.com/pagead/js/r20220201/r20110914/client/ Frame 9D46 37 KB
14 KB 23ms
22ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220201/r20110914/client/one_click_handler_one_afma.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f027bb2c9eef53b4e733541862b91f03dcac7a46e72bb21fea574b49820207e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 06 Feb 2022 20:24:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16619
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14230
x-xss-protection: 0
server: cafe
etag: 17686556044343836991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Feb 2022 20:24:08 GMT

GET
H3 200 11768450557675993369
tpc.googlesyndication.com/simgad/ Frame 9D46 10 KB
10 KB 31ms
30ms Image
image/png 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11768450557675993369?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmtSKUt7qAAlHRwjGFLtEHgiz5qNg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3859244ec8dcb2a62ebf781af8d49b37fef784fbb3f519803645b8f05632253e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 04 Feb 2022 13:26:14 GMT
x-content-type-options: nosniff
age: 214493
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10438
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:16:57 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 04 Feb 2023 13:26:14 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 9D46 0
17 B 91ms
90ms Image
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=ChZUyUW8AYq3iO8qBoPwP3rCE2ASusPiHaOLmzpnID6z65Ij3JRABIOaX1iVgfaAB79HcjgPIAQKoAwHIA8kEqgTgAU_Qd6l-OWhaoVuEV_QRvkd6KrXNaXoKgUQD0jcnedZNZg0cKnFOANHVmQMcbf-UgrEe1DIbG9fYkqxxbmjrkiLGf4O4X8bzo95rbTo1fxLhJXqPOVDVkeDmTArV2xujUgMffrbX7pKSUzFvZ7b9iUev0HpvubTuA_6IrbEf0MgSeCLXvXru3IfAYxk5h2k_w7sm2upzEdrwIjdrPGrmsoUMoT2pyaxxPL6EuEl9mFBXNx1Vc270bHSdxYtl4ppWEWZnxUVPUnDh1ho5LXzhFTfUaQ8RQJZvrF4OrfPI1h4DwASw__HGhgSSBQQIBBgBkgUECAUYBKAGAoAH-a2jcagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB0ggHCIBhEAEYAPIIDmJpZGRlci01MTQ3MDQ3gAoEyAsB2BMM0BUBgBcBshcICgYIABIAGAA&sigh=5MEgGzt9O60&uach_m=[UACH]&pr=10:1.744896&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 07 Feb 2022 01:01:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 83ms
83ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022020101&jk=1909829915837632&bg=!NjWlNXHNAAa4sGsQuLA7ACkAdvg8WmW48vss9daXEp2hJFKAStY0PkfjkL8yTqF7bojY0Z08OO_XpwIAAAGZUgAAAAJoAQcKACILF4RG5YXHm7ZSGx5CoMQHAFGcnQ7Q5x_PxF658ND5RreymQKXGvU8cM_5BBIEMi6ye6mqxMhms7WcpDL3dXgL5OwF7SKel8Yxl_7BzH_DsWc6TeIPZ4OG3h8HuWe4pvgOs4rrrYIH1l6Ztjh6defzYQyqbR1xt0vSloY19jKPFJMO22TyXJ1xTxl_wq9bk7e12EqOpQhiviO1wUNrTwLPCfYnWC-pFR59FdQkbYnRHStAEeskALKNAtGHm21IffkoCLfQ0ecbZv2_Ow8G1y5ir7ZN7-pL3PfkmraBAtvAfILNYWaQmWrypuQ4wDf95QI9b0WLhAJLOTAqb6gRf6o-R479_oFCHlMKIWz_pdYA-dMgpryqK_oJxECrBs82yde-IDo67aotPKJtixr2mcQI-72qldjt44HtF9yXssgyaNHhq0HJRn8a8jTU2AsCjmM9nT6YV8lDKWzULAbuHdsUlNMqTTqjc8Rq9V8EjwvdRhhs1scOb7x1YGc0TrvaWlFBPsXbIrfeucHl9wwIAtsMiWfk14uUOLOXGsPQIpbWCEUESzGKGk6KScDabuNgXj87CuNurqZJvT_mlCiD5sI8qBVuEdx0s1NkkSNJ5-wZeTpfFzDseZnwpkxx9f4J3b2kCyTYRkgfzltTdDG5islgTZ9EcWR9g2XHB4NgXJdralSH9Xkq7f49bPBXkob66t6Lp4VtEKlEoU3oiUteHxj3Iwx_U-_TvEyC6gZoiHGlFp8T1V2pVh-cOVpfQg-DhxgI46g3RYC8TtwheajTg9Z8_TtsxQ8e-qWd_2Aln4td-7Q7EGHGYg-IWCabscyG6XLbkSKnNbLBk8chmLxryyotBcYh3rj4wKCMWwEslvG9-D7sF8mJ6AOcy4uiq1k07yxYL2DF-Lf296a_lzrV_LOc0fjIjsnsfl1MrAUI

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6ADC 143 B
163 B 20ms
20ms Document
text/html 2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Mon, 07 Feb 2022 00:18:25 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 2562
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6ADC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

45ms
44ms

Document
text/html

2607:f8b0:4006:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:824::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 07 Feb 2022 01:01:07 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 07 Feb 2022 01:01:07 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 07 Feb 2022 01:01:07 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 9D46 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad2c6b348b7aa92414189e883dfb55d470b8ad3b60ac1b393c2e003034e94451

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 35DA 0
20 B 82ms
82ms Image
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B8hpfU28AYoyrB4LbMLyeqNgJAAAAADgB4AQC&bg=!V1SlVBDNAAYZkRhwGZE7ACkAdvg8WnMFnZZ0dSYm9ycjU0hn8mA2cKpnsSsrivQESo2_WwBfo2iuWwIAAACZUgAAAAJoAQeZAy2AezHuQcQOrBNkfXgZernPQ8a-c1NaFS3CeO7faDzPenAGjjvJ1NQTBRn1cxB95uWD2lHJFTcXhoVQG3Y_CUCvLVsqpXybQ6QgXaYYp0qCH8cb_0SWfKuhUJqVRWmrAR9BM-LYUNR_bpHPkWc_eHlAXnNoshjm3ysel4kPklJtfFDMhdIuzYRhHkXpA2VFphdOewOoUZY9_7g4w-XBXsMG-OsgxEpGGjV2NnT3n4AWRIIgZlaWUQfNe1M3JXfE4SRd0rj9DXwu2MEgZ_7RttQS0NbmfgqpEwlJWyLvYMZ-7nC7olt0YVZDoIevH3EtaNuoOPUWqNiKTJ2VxoxO0eyMdMMBwmRoQ_bIeNTSkSDZniu-S03ky1r6KvsO4dcol7PRAo19fmbDYlpQWbd1GBONIfdCmW_vjyqv9U6mCEh2eLHtyXQIbGP_CY1v4aFHTyHSr2JXa-or4kHUMfgQqcyeRVBFyOzLHFOGDnBzgnD4Tg7y2OApPmlo1KDTT_97BIAMe9IbkHxQcWVnD-VqUDL5H7bAWvugH3zXFjvAeEZpaIJUrJzcSfQHyFjiysKWij32WtKaWQ7rX_RFLYd9gluusazZ7Ricm_mEbHjAvuvnvOoVv_PF3OU8CYdgS5OXm6vanlvPRKMiN0bG0CkYoP4UBf4N4yj_xBcEbpLhbtjV6HwPS5BBS9saP9sb5EhMdhzJab3eyu0dBxgxppUyK2S4V90mQISk_Y1aZBp7MMxeKRxeEabdqeLVGtqe4jWwDxL4ZCkhh2h1A0Y3uE-m5Ej6sblELr64FwIQZgUTJhoTZcnJYDjfO57jvNLlmePx4mvKtgnJ7297IIqDPY74saN9yyfk96x8Wvzj7XEOeo9mMc-nSrY6gx8QeS97V7qFsEydmhELnUkuPQA8cC0FXRElou8E5T3WjzoPG43Kw1voZGl7Pq6Ynq2fgICb4k8K525ChaTyp_wjJKvTecA7OjWiRpeM6v-Qv1eT54o-pk1UUNY_6aatIYyupP1JTgL-MzUXNf-tfP4EgKwmCUfeiTTWMFpk6tgoz5na--z6dZJvtRc_MAwA9ayNNAOWj0Y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 034D
Redirect Chain

https://dmx.districtm.io/s/v1/users/10002
https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qUnNRMFJhU205RGJYZDNVSEZYUVdaSGVuaHdURzF4VFZreCJ9.c0QYH2HJaRuVXSMsM6ve5-...

43 B
556 B

34ms
33ms

Image
image/gif

209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qUnNRMFJhU205RGJYZDNVSEZYUVdaSGVuaHdURzF4VFZreCJ9.c0QYH2HJaRuVXSMsM6ve5-5dvKuAKo6JpVy4GxuU46__iW3O61_e4z4j57S8xtIOkvyOHaRPwbRqsHnCBpr7xA

Protocol

HTTP/1.1

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:07 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: JQBCBCSCF1KRBZY2G9Y7
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Mon, 07 Feb 2022 01:01:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
location: https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qUnNRMFJhU205RGJYZDNVSEZYUVdaSGVuaHdURzF4VFZreCJ9.c0QYH2HJaRuVXSMsM6ve5-5dvKuAKo6JpVy4GxuU46__iW3O61_e4z4j57S8xtIOkvyOHaRPwbRqsHnCBpr7xA
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6d98af6bc9ac8c15-EWR
access-control-allow-headers: Origin, Content-Type
content-length: 0

GET
H3 200 K3QqjkDtpTyrF38W5JrZ5ol4_5B02gVdFCmanKaTR4c.js Show response
pagead2.googlesyndication.com/bg/ Frame 0ED7 35 KB
13 KB 27ms
26ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/K3QqjkDtpTyrF38W5JrZ5ol4_5B02gVdFCmanKaTR4c.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b742a8e40eda53cab177f16e49ad9e68978ff9074da055d14299a9ca6934787

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 06 Feb 2022 17:18:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27764
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13776
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 06 Feb 2023 17:18:23 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
28 KB 90ms
37ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

5f1a0eb046f22533fd96fde5da0c9f951cb8b69354839596657271c9af223be0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:08 GMT
content-encoding: gzip
last-modified: Mon, 24 Jan 2022 04:27:55 GMT
server: nginx
etag: W/"61ee2acb-16429"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 08 Feb 2022 01:01:08 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 338A 13 KB
5 KB 102ms
101ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=create.cprewritten.net&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

cdf0b0f2c5cef0e09f6cc68cb1a183831eba5c571627b3862c0d959de0350678

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 2472
date: Mon, 07 Feb 2022 01:01:07 GMT
content-length: 5182
strict-transport-security: max-age=31536000; preload;

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
28 KB 102ms
47ms XHR
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

5f1a0eb046f22533fd96fde5da0c9f951cb8b69354839596657271c9af223be0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:08 GMT
content-encoding: gzip
last-modified: Mon, 24 Jan 2022 04:27:55 GMT
server: nginx
etag: W/"61ee2acb-16429"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 08 Feb 2022 01:01:08 GMT

GET
H2

200

/ Show response
sync.richaudience.com/74889303289e27f327ad0c6de7be7264/ Frame 672D
Redirect Chain

https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]
https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]&rd=1

2 KB
1 KB

107ms
107ms

Document
text/html

168.119.149.178
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]&rd=1
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.119.149.178 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.178.149.119.168.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: a44f2959a1d52442b9645bcc50698fb25f5017c4809761ac91025f7aa40aaaed

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/

Response headers

server: nginx/1.14.2
date: Mon, 07 Feb 2022 01:01:08 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-encoding: gzip

Redirect headers

server: nginx/1.14.2
date: Mon, 07 Feb 2022 01:01:08 GMT
content-type: text/html; charset=UTF-8
location: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]&rd=1
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H2

200

sid Show response
mug.criteo.com/ Frame 338A
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=create.cprewritten.net&sn=ChromeSyncframe&so=0&topUrl=create.cprewritten.net
https://mug.criteo.com/sid?cpp=7sUf-XxGKzh2Nml1V0VJS1FYankxVllVcWFOdDZWV3E3NXIrVjgrbWZjcnc0ei9EZzRSVDhoYng5RmhtUWhnZ3JqYmFtYWJmdEpqNEdGQk5IcjMyNTBMUzZNQ2FsdnVkLzBuL2FUY1ZWNDBLRzRqMWtHR3hEbVNmUnF6T1...

350 B
568 B

27ms
26ms

Fetch
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=7sUf-XxGKzh2Nml1V0VJS1FYankxVllVcWFOdDZWV3E3NXIrVjgrbWZjcnc0ei9EZzRSVDhoYng5RmhtUWhnZ3JqYmFtYWJmdEpqNEdGQk5IcjMyNTBMUzZNQ2FsdnVkLzBuL2FUY1ZWNDBLRzRqMWtHR3hEbVNmUnF6T1RrOVJFRzVmMVA0ZzFTM1NldWFPbG55T0tXa1NLWkRsT3JIQytMMHNxNDNiY3VHYTFLKzBRR084bzZQV0p2b1JrYmhEUVJQY0ZNdzhubTlHdDdZYU5kUXg0WFFFNC9RPT18&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

1d93b7ba064902e7a657482dbb52ab3c7d46c3683b86c4d3782aaf3c6a8088d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:07 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 5510
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:08 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=7sUf-XxGKzh2Nml1V0VJS1FYankxVllVcWFOdDZWV3E3NXIrVjgrbWZjcnc0ei9EZzRSVDhoYng5RmhtUWhnZ3JqYmFtYWJmdEpqNEdGQk5IcjMyNTBMUzZNQ2FsdnVkLzBuL2FUY1ZWNDBLRzRqMWtHR3hEbVNmUnF6T1RrOVJFRzVmMVA0ZzFTM1NldWFPbG55T0tXa1NLWkRsT3JIQytMMHNxNDNiY3VHYTFLKzBRR084bzZQV0p2b1JrYmhEUVJQY0ZNdzhubTlHdDdZYU5kUXg0WFFFNC9RPT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1796
content-length: 455
expires: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E545 42 B
64 B 99ms
65ms Fetch
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuSnsyFi62-DPfJHF_Twf3aRO0KTMQ4xwMhBpQGdhpzZsaD3OCU70nKVQVNZIpx-XKeGPa0xp3TCccX-YKcvih6x3B8xIxvZgi5NItg4FbA3VjZY78&sai=AMfl-YStN7PEP3JqIwZ44-2COHASxHvqpf-ILQJfeWHj90xq7LzWrCjEMeaOawVvbo61HBP9J1g1twEYjAHLbO8HA4-t-v64_efgQRmT8nGHGLP4G6YNeDjUhCObzfQ1bpM&sig=Cg0ArKJSzB0k9sJb7_OzEAE&cid=CAASFeRoyRy8BgAtHdoRgynTAPjL-ZpQGA&id=lidar2&mcvt=1000&p=212,436,306,1164&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20220202&bin=7&avms=nio&bs=0,0&mc=0.96&if=1&app=0&itpl=20&adk=937356322&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644195666919&rpt=501&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://49e2a20f940266506becfbe0186ecf8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200 341.json Show response
id5-sync.com/g/v2/ 2 KB
2 KB 127ms
127ms XHR
application/json 51.195.5.232
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/341.json

Requested by

Host: create.cprewritten.net
URL: https://create.cprewritten.net/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.195.5.232 , France, ASN16276 (OVH, FR),

Reverse DNS

p15.id5-sync.com

Software

Resource Hash

d86ec6ecfad6cfbfdc76d7ba38a5bd81602391c5e82a1ba1ce91b80f37f1a80a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 07 Feb 2022 01:01:08 GMT
Vary: Origin
P3P: CP="CAO PSA OUR"
Access-Control-Allow-Origin: https://create.cprewritten.net
Access-Control-Allow-Credentials: true
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8
Transfer-Encoding: chunked

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
715 B 49ms
49ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=cw39kyg&fmt=json
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: d5fb752983b90032316b9d0fa9e3ecdfaabafd0546c05c39be9608105d59e7ae

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 07 Feb 2022 01:01:08 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://create.cprewritten.net
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Wed, 09 Mar 2022 01:01:08 GMT

GET
H2 451 envelope Show response
api.rlcdn.com/api/identity/ 0
257 B 154ms
66ms XHR
text/plain 34.120.155.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity/envelope?pid=76
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.155.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.155.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 07 Feb 2022 01:01:08 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://create.cprewritten.net
access-control-allow-credentials: true
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 0

GET
H2 200 id Show response
id.sharedid.org/ 41 B
377 B 361ms
132ms XHR
text/plain 54.70.210.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.sharedid.org/id?us_privacy=1---
Requested by: Host: create.cprewritten.net
URL: https://create.cprewritten.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.70.210.121 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-70-210-121.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: bea3e4866ee3a0f4c5f028861d31b0f0c4238d2622d7274847084ac1b57b8a1a

Request headers

Referer: https://create.cprewritten.net/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:08 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://create.cprewritten.net
cache-control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 41
expires: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 09E7 15 KB
6 KB 56ms
55ms Document
text/html 184.29.128.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156538&s=156538&gdpr=0&gdprConsent=&predirect=https%3A%2F%2Fsync.richaudience.com%2Fa8c1b6a2754b510b088f624c91944bf3%2F%3FpmUserId%3D
Requested by: Host: sync.richaudience.com
URL: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]&rd=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.29.128.213 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-29-128-213.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://sync.richaudience.com/

Response headers

server: Apache/2.2.15 (CentOS)
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5549
content-type: text/html; charset=UTF-8
cache-control: max-age=141392
expires: Tue, 08 Feb 2022 16:17:40 GMT
date: Mon, 07 Feb 2022 01:01:08 GMT
vary: Accept-Encoding

GET
H2 204 sync
pixel.advertising.com/ups/58170/ Frame 672D 0
124 B 52ms
50ms Image
text/plain 34.231.145.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/58170/sync?gdpr=1&gdpr_consent=&_origin=1&redir=true

Requested by

Host: sync.richaudience.com
URL: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]&rd=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.231.145.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync.richaudience.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:08 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
sync.richaudience.com/1334b6ec0ff0dc970481738a2374448c/ Frame 672D
Redirect Chain

https://ups.analytics.yahoo.com/ups/58368/occ?gdpr=0&gdpr_consent=
https://sync.richaudience.com/1334b6ec0ff0dc970481738a2374448c/?uid=y-wqhVSvdE2uElNtHfOWiIUf3AMP113Ea14KoAszs-~A&gdpr=0&gdpr_consent=

95 B
369 B

137ms
137ms

Image
image/png

168.119.149.178
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/1334b6ec0ff0dc970481738a2374448c/?uid=y-wqhVSvdE2uElNtHfOWiIUf3AMP113Ea14KoAszs-~A&gdpr=0&gdpr_consent=
Requested by: Host: sync.richaudience.com
URL: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]&rd=1
Protocol: H2
Server: 168.119.149.178 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.178.149.119.168.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync.richaudience.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:08 GMT
server: nginx/1.14.2
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/png

Redirect headers

location: https://sync.richaudience.com/1334b6ec0ff0dc970481738a2374448c/?uid=y-wqhVSvdE2uElNtHfOWiIUf3AMP113Ea14KoAszs-~A&gdpr=0&gdpr_consent=
date: Mon, 07 Feb 2022 01:01:08 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
sync.richaudience.com/f79aa10af28935c0f42d7bcb6a649769/ Frame 672D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.richaudience.com%2Ff79aa10af28935c0f42d7bcb6a649769%3Fuid%3D%24%7BUSER_ID%7D
https://sync.richaudience.com/f79aa10af28935c0f42d7bcb6a649769?uid=YgBvUgAEUHzwywBH
https://sync.richaudience.com/f79aa10af28935c0f42d7bcb6a649769/?uid=YgBvUgAEUHzwywBH

95 B
347 B

145ms
145ms

Image
image/png

168.119.149.178
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/f79aa10af28935c0f42d7bcb6a649769/?uid=YgBvUgAEUHzwywBH
Requested by: Host: sync.richaudience.com
URL: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]&rd=1
Protocol: H2
Server: 168.119.149.178 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.178.149.119.168.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync.richaudience.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:08 GMT
server: nginx/1.14.2
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/png

Redirect headers

location: https://sync.richaudience.com/f79aa10af28935c0f42d7bcb6a649769/?uid=YgBvUgAEUHzwywBH
date: Mon, 07 Feb 2022 01:01:08 GMT
server: nginx/1.14.2
content-length: 185
content-type: text/html

GET
H2

200

/
sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/ Frame 672D
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.richaudience.com%2Fa939d25b950298d0a5d324cea4fcd3d1%2F%3Fuid%3D$UID
https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=402116596189329890

95 B
346 B

133ms
133ms

Image
image/png

168.119.149.178
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=402116596189329890
Requested by: Host: sync.richaudience.com
URL: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]&rd=1
Protocol: H2
Server: 168.119.149.178 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.178.149.119.168.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync.richaudience.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:08 GMT
server: nginx/1.14.2
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:08 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: ac3f6447-cf2a-462b-a37f-1a96b5f64a5d
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://sync.richaudience.com/a939d25b950298d0a5d324cea4fcd3d1/?uid=402116596189329890
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

/
sync.richaudience.com/1988B3F6BED450961C9D70DD91/ Frame 672D
Redirect Chain

https://spl.zeotap.com/?zdid=689&env=mWeb&eventType=pageview
https://sync.richaudience.com/1988B3F6BED450961C9D70DD91/?uuid=1c1d0345-0fde-4ee2-70e7-0301a322d2ae&env=mWeb&eventType=pageview&id_mid_4=1c1d0345-0fde-4ee2-70e7-0301a322d2ae&reqId=14702830-c94d-460...

95 B
357 B

147ms
146ms

Image
image/png

168.119.149.178
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/1988B3F6BED450961C9D70DD91/?uuid=1c1d0345-0fde-4ee2-70e7-0301a322d2ae&env=mWeb&eventType=pageview&id_mid_4=1c1d0345-0fde-4ee2-70e7-0301a322d2ae&reqId=14702830-c94d-4607-7065-aa29baf0bf20&zdid=689
Requested by: Host: sync.richaudience.com
URL: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]&rd=1
Protocol: H2
Server: 168.119.149.178 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.178.149.119.168.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync.richaudience.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:08 GMT
server: nginx/1.14.2
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type: image/png

Redirect headers

date: Mon, 07 Feb 2022 01:01:08 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
location: https://sync.richaudience.com/1988B3F6BED450961C9D70DD91/?uuid=1c1d0345-0fde-4ee2-70e7-0301a322d2ae&env=mWeb&eventType=pageview&id_mid_4=1c1d0345-0fde-4ee2-70e7-0301a322d2ae&reqId=14702830-c94d-4607-7065-aa29baf0bf20&zdid=689
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: text/html; charset=utf-8
access-control-allow-origin: https://sync.richaudience.com
access-control-allow-credentials: true
cf-ray: 6d98af710c047145-YUL
access-control-allow-headers: *

GET
H2 200 setuid
mp.4dex.io/ Frame 672D 0
521 B 132ms
130ms Image
text/plain 2606:4700::6812:272
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mp.4dex.io/setuid?bidder=richaudience&us_privacy=1---&uid=abaa8b73-bd80-486e-bcfe-1zz1644195668
Requested by: Host: sync.richaudience.com
URL: https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&ccpa_consent=1---&r=https%3A%2F%2Fmp.4dex.io%2Fsetuid%3Fbidder%3Drichaudience%26us_privacy%3D1---%26uid%3D[PDID]&rd=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:272 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://sync.richaudience.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:08 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
cache-control: no-cache, no-store, must-revalidate
cf-ray: 6d98af706f7b4bc5-YUL
content-length: 0
expires: 0

GET
H2

200

ProfilesEngineServlet
api.intentiq.com/profiles_engine/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=b0d60b5dd6&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us.gif?nw=td&nuid=de71345a-edfe-429a-9e27-b13a5e9ebea0&pubid=b0d60b5dd6
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=570392714&pt=17&dpn=1&dpt=&trid=&pcid=952fd169-ed03-491c-b5a2-af70efd0d80c
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=570392714&pt=17&dpn=1&dpt=&trid=&pcid=952fd169-ed03-491c-b5a2-af70efd0d80c&ckls=true&ci=CqiqFVsEfA&nc=false&trid=-1009...
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&pu=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1402230080%26mi%3D10%26csh%3D570392714%26rnd%3D40...
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=1402230080&mi=10&csh=570392714&rnd=40459130&pcid=235A5332-1129-4F0C-B691-00DE56507837
https://ib.adnxs.com/getuid?https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1709765917%26mi%3D10%26csh%3D570392714%3B1402230080%26rnd%3D273752072&pcid=$UID
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=1709765917&mi=10&csh=570392714;1402230080&rnd=273752072&pcid=402116596189329890
https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1486637409%26mi%3D10%26csh%3D570392...
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=1486637409&mi=10&csh=570392714;1402230080;1709765917&rnd=-1038643359&pcid=ca3e7c1d-df44-0c8b-3587-c65dd8552465
https://ce.lijit.com/merge?pid=8101&3pid=CqiqFVsEfA&location=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D396218182%26mi%3D10%26csh%3D570392714%3B14022...
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=396218182&mi=10&csh=570392714;1402230080;1709765917;1486637409&rnd=770135947&pcid=c1243ebe78df80deee655c12
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1072441116%26mi%3D10%26csh%3D570392714%3B140...
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1072441116%26mi%3D10%26csh%3D570392714%3B140...
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=1072441116&mi=10&csh=570392714;1402230080;1709765917;1486637409;396218182&rnd=-1123647858&pcid=6fcc8f83-87b1-11ec-86d2-13033...
https://sync.mathtag.com/sync/img?mt_exid=10019&redir=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1678944572%26mi%3D10%26csh%3D570392714%3B1402230080%...
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=1678944572&mi=10&csh=570392714;1402230080;1709765917;1486637409;396218182;1072441116&rnd=-558880280&pcid=30bf6200-6f52-4100-...
https://sync.1rx.io/usersync/intentiq/0?dspret=1&redir=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D541745869%26mi%3D10%26csh%3D570392714%3B1402230080%...
https://sync.targeting.unrulymedia.com/csync/RX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005?redir=https%3A%2F%2Fapi.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D541745869%2...
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=541745869&mi=10&csh=570392714;1402230080;1709765917;1486637409;396218182;1072441116;1678944572&rnd=-193767871&pcid=RX-68074e...

43 B
1 KB

29ms
28ms

Image
image/gif

52.85.61.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=541745869&mi=10&csh=570392714;1402230080;1709765917;1486637409;396218182;1072441116;1678944572&rnd=-193767871&pcid=RX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005
Protocol: H2
Server: 52.85.61.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-61-53.ewr53.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:09 GMT
via: 1.1 c22d4946ef5faea12b8d3942ceb9259a.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: EWR53-P1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
x-amz-cf-id: oLmtQ7hrybHJz1z5qjMxNKu7hKj1sK94G53SqV_-UjwQhahYurxm2Q==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Mon, 07 Feb 2022 01:01:09 GMT
Server: Tengine
ETag: RX68074e063a3045bfb31eb48d56fdbb5b005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=541745869&mi=10&csh=570392714;1402230080;1709765917;1486637409;396218182;1072441116;1678944572&rnd=-193767871&pcid=RX-68074e06-3a30-45bf-b31e-b48d56fdbb5b-005
Connection: keep-alive
Content-Type: text/html

GET
H2

200

235A5332-1129-4F0C-B691-00DE56507837
pr-bh.ybp.yahoo.com/sync/pubmatic/
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=157230&gdpr=0&gdpr_consent=&us_privacy=1---
https://pr-bh.ybp.yahoo.com/sync/pubmatic/235A5332-1129-4F0C-B691-00DE56507837?gdpr=0&gdpr_consent=

43 B
986 B

66ms
66ms

Image
image/gif

2600:1f18:4e9:5a01:8195:c898:f037:e181
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/235A5332-1129-4F0C-B691-00DE56507837?gdpr=0&gdpr_consent=

Protocol

Server

2600:1f18:4e9:5a01:8195:c898:f037:e181 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 01:01:08 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/pubmatic/235A5332-1129-4F0C-B691-00DE56507837?gdpr=0&gdpr_consent=
date: Mon, 07 Feb 2022 01:01:07 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 126
content-type: text/html; charset=utf-8

GET
H3

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://us-u.openx.net/w/1.0/pd?plm=6&ph=674700d8-56f8-4e0c-aecf-b9c3ebe8f945&gdpr=0&us_privacy=1---
https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8645764599013987625&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

53ms
53ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8645764599013987625&gdpr=0&gdpr_consent=&us_privacy=
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:08 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8645764599013987625&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Mon, 07 Feb 2022 01:01:08 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID]
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=30bf6200-6f52-4100-a005-c1ed9289aa7e

49 B
864 B

137ms
57ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=30bf6200-6f52-4100-a005-c1ed9289aa7e

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:08 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-57
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: image/gif
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Mon, 07 Feb 2022 01:01:08 GMT
Server: MT3 4133 baa842e master iad-pixel-x3 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=30bf6200-6f52-4100-a005-c1ed9289aa7e
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 07 Feb 2022 01:01:07 GMT

GET
H2 204 /
onetag-sys.com/usync/ 0
52 B 37ms
35ms Image
text/plain 51.222.39.186
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/usync/?tag=img&us_privacy=1---

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.186 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip186.ip-51-222-39.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform

GET
H/1.1

200
OK

us.gif
sync.go.sonobi.com/
Redirect Chain

https://x.bidswitch.net/sync?ssp=sonobi&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=sonobi&bsw_param=71752e87-3832-4eac-809a-985a64d26fbc&google_hm=NzE3NTJlODctMzgzMi00ZWFjLTgwOWEtOTg1YTY0ZDI2ZmJj
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEP9irPkB_WrQuGVbSnTUvN8&google_cver=1&ssp=sonobi&bsw_param=71752e87-3832-4eac-809a-985a64d26fbc
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=71752e87-3832-4eac-809a-985a64d26fbc

49 B
864 B

77ms
76ms

Image
image/gif

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=71752e87-3832-4eac-809a-985a64d26fbc

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 07 Feb 2022 01:01:08 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-57
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: image/gif
Content-Length: 49
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: //sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=71752e87-3832-4eac-809a-985a64d26fbc
Date: Mon, 07 Feb 2022 01:01:08 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9643 42 B
64 B 73ms
72ms Fetch
image/gif 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsveIdqtTnN2D6ZURrUOzNXt_MQKu2RkC3_wurgcxKPx_UV4KeEfOB6qySd1QYijsRODIj_n6Ty7k1uCUJd1YPyuLBc7BzguO5EDc10tefOB_XZEAbF8&sig=Cg0ArKJSzNbCnLULqr4nEAE&id=lidar2&mcvt=1001&p=953,566,1013,1034&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=887187448&rs=4&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644195667232&rpt=311&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://create.cprewritten.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 07 Feb 2022 01:01:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame 9643 0
833 B 47ms
46ms Ping
text/html 68.67.179.154
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fcreate.cprewritten.net%2F&e=wqT_3QKHBugHAwAAAwDWAAUBCNHegZAGEILBiOnpwsjeCxgAKjYJTb1uERjr-z8RR7fzN4AC-D8ZAAAA4HoUGUAhRw0SACkRJNAxAAAAYI_C7T8wr5enCTjhOUDlHkhlUNiiyyVYn-WJAWAAaNiroQF4qskFgAEBigEDVVNEkgUG8GGYAdQDoAE8qAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKZgVvqAh9odHRwczovL2NyZWF0ZS5jcHJld3JpdHRlbi5uZXQvgAMAiAMBkAMAmAMXoAMBqgPpAQq_ARE1cHBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tDR5EL2dlbl8yMDQ_aWQ9YXdiaWQmBQb0aQFfYj1BS0FtZi1Ed2d3ZVVUY2ZtNTdycE03cDhUU1kxUmRfdy1vRzJrLWRyLUhWRnM5S3I0UW1reHNsazNrdC04U0pnZjFzYjZzOHR3OG9iWVhLX0ZHZ05lY2NYZkJiSk9fbjg5USZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhI4NDU4Njk3ODU1MzY0MDU2MzQiCDc4ODI3ODY0KgQzOTQxOgEwwAOsAsgDANgD0NCpAeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4MagEALIEDwgAEAEY1AMgPCgAMAA4ArgEAMAEAMgEANoEAggB4AQB8ATYossliAUBmAUAoAXhq_GDm_y77DfABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWwl0v6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG7o8B2gYWChAAAAAAAAUWCQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTM5MTk4MjM0NTQ0ugcRCAABKUwqBDEtLS04tARAAcgHqskF0gcNCQlHAAAFSQjaBwYJKUTgBwDqBwIIAPAHxP8HiggCEAA.&s=cf098ad996bfdd6b50c99ef703735c653c1a707c&type=pv&jm=1003&px=563&py=953&bw=468&bh=60&sf=1&sid=4194147221086081172&vd=ct~0|rr~5&sv=222&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=19516335&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/222/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.154 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS